Two members of the notorious Scattered Spider cybercrime group were sentenced to five and a half years in prison Thursday for the 2024 cyberattack on Transport for London, marking the largest cybercrime prosecution in UK history.
Owen Flowers, 18, and Thalha Jubair, 20, pleaded guilty under Section 3ZA of the Computer Misuse Act 1990. The Crown Prosecution Service said Flowers and Jubair are believed to be the first hackers successfully prosecuted under this section.
The attack disrupted transport services across London, including Dial-a-Ride for vulnerable passengers, concessionary travel cards, and digital payments. All 27,000 TfL employees were forced to reset their passwords in person, while 148 systems went offline. Customer data from the Oyster refunds system was also exposed.
TfL estimates the cost at 29 million pounds ($39 million). The NCA arrested the two teenagers at their home addresses in September 2025. Investigators found evidence linking Flowers to intrusions against US healthcare providers. Microsoft assessed that the arrests have materially degraded the group ability to conduct cyber operations.
