Scattered Spider hackers sentenced to 5.5 years over £29 million Transport for London hack

Two leading members of the Scattered Spider cybercrime collective, Thalha Jubair, 20, of East London, and Owen Flowers, 18, from Walsall in England’s West Midlands, have been sentenced to more than five years in prison for their involvement in a 2024 cyberattack against Transport for London (TfL). The attack, which occurred in 2024, concluded what British authorities described as the largest cybercrime prosecution ever brought before a U.K. court.

Thalha Jubair and Owen Flowers admitted to infiltrating TfL’s network, causing widespread operational disruption and exposing customer data. The attack resulted in £29 million in recovery expenses for TfL. The prosecution is only the second ever brought under the U.K.’s most serious Computer Misuse Act offense, which covers unauthorized computer activity that causes, or risks causing, serious damage to critical infrastructure or public welfare and carries a maximum sentence of life imprisonment.

Authorities said that despite TfL’s efforts to prevent the attack from shutting down London’s transport network, the intrusion caused significant operational disruption. The attack forced all 27,000 TfL employees to attend offices for in-person password resets, while 148 internal systems became unavailable, including critical operational platforms that required extensive manual workarounds. The breach also compromised data held within TfL’s refund system for Oyster — the cards used by passengers for travel — leaving some passengers waiting significantly longer than normal for refunds. Applications for Oyster photocards used by children and young people were temporarily suspended.

The National Crime Agency (NCA) stated that the financial consequences could have been significantly worse, saying that if the attackers had succeeded in disabling London’s transport network, the estimated economic impact could have reached £56 billion ($75.6 billion). British investigators identified Jubair and Flowers as leading members of Scattered Spider, a loosely organized English-speaking cybercriminal network responsible for numerous high-profile intrusions targeting organizations across the U.K. and United States. The group has been linked to attacks against airlines, retailers, insurers and technology companies, often relying on social engineering, SIM-swapping and credential theft to gain initial access before deploying ransomware or conducting extortion campaigns.

According to the NCA, arrests carried out in September 2024 significantly disrupted the group’s operations. “Scattered Spider has been the most significant cybercrime threat to the U.K. in recent years. Through this investigation, we have severely disrupted that threat and brought key offenders to justice,” said Paul Foster, deputy director of the NCA’s National Cyber Crime Unit. The agency added that independent analysis supported that assessment, with Microsoft concluding the arrests had materially degraded Scattered Spider’s ability to continue conducting cybercriminal operations.

Flowers was first arrested in September 2024, while investigators said he was simultaneously compromising systems belonging to U.S. healthcare providers SSM Health Care Corporation and Sutter Health. Searches of his home uncovered laptops, desktop computers, external hard drives and USB devices. One laptop contained a screenshot showing connectivity to TfL’s infrastructure, while investigators also recovered videos allegedly recorded by Flowers showing Jubair actively accessing TfL systems during the intrusion. The pair coordinated the attack through Telegram and an online collaborative workspace.

Flowers was later rearrested after breaching bail conditions relating to restrictions on device usage. Jubair also faced an additional charge after refusing to disclose passwords and PINs for seized electronic devices. Security officials said the case demonstrated both the growing sophistication of cybercriminal groups and the importance of early reporting by victims. “The attack on Transport for London caused significant financial harm and disruption to a vital part of the UK’s critical infrastructure,” Foster said, adding that the convictions would likely not have been possible without TfL’s prompt engagement with law enforcement.

Commander Ollie Shaw of the City of London Police used the sentencing to argue for proposed Cyber Crime Risk Orders, which would allow courts to impose technology restrictions on convicted cyber offenders after release. The proposed measures could limit offenders’ access to devices, online services or technologies frequently used to commit cybercrime, creating what Shaw described as a form of “digital prison” designed to reduce reoffending while allowing rehabilitation. Security Minister Angela Eagle said the case illustrated the risks cybercriminals pose to Britain’s economy and national infrastructure: “This should send a clear message to anyone planning illegal cyber activity that there will be consequences when you are caught,” she said. London’s Transport Commissioner Andy Lord welcomed the sentencing, thanking investigators and TfL staff who helped respond to the incident and restore affected systems. The investigation was led jointly by the National Crime Agency and City of London Police, with support from the West Midlands Regional Organised Crime Unit, British Transport Police and international partners including the FBI. Jubair and Flowers were also both arrested last July on suspicion of involvement in a series of ransomware attacks targeting British retailers Marks & Spencer, the Co-op and the London-based luxury store Harrods. No suspects have yet been charged with those crimes.