Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack
Two young British hackers, Owen Flowers and Thalha Jubair, were convicted and sentenced to five and a half years for a sophisticated attack on Transport for London (TfL), resulting in significant disruption and financial losses. The attackers exploited vulnerabilities to gain access to critical systems, causing widespread operational issues and forcing a massive password reset process for all TfL employees.
Owen Flowers, 18, and Thalha Jubair, 20, were sentenced to five and a half years at Woolwich Crown Court on Thursday, 16 July 2026, for the 2024 hack of Transport for London. The attack, carried out by the Scattered Spider hacking group, compromised 148 TfL systems, severely impacting the transport authority's operations. As a direct result of the intrusion, all 27,000 of TfL’s employees were required to visit an office to have their passwords reset in person, a costly and time-consuming process. The NCA and the CPS collaborated to prosecute the duo, highlighting the serious consequences of cybercrime against essential public services. The attackers exploited vulnerabilities within TfL’s systems to gain unauthorized access, demonstrating a targeted and deliberate effort to cause disruption.