Two Teenagers Sentenced for £29 Million Cyberattack on Transport for London
A UK court has sentenced Thalha Jubair, 20, and Owen Flowers, 18, members of the cybercrime group Scattered Spider, to five years and six months in prison for their roles in a significant cyberattack on Transport for London (TfL) in 2024. The attack severely disrupted various transport services, including Dial-a-Ride for vulnerable passengers and digital payment systems, and compromised customer data from the Oyster refunds system. As a result, TfL incurred an estimated cost of £29 million, while the National Crime Agency (NCA) indicated that a complete shutdown could have led to economic damages as high as £56 billion.
The NCA arrested both teenagers in September 2025 at their homes. Flowers was initially apprehended for the TfL attack, and investigators uncovered evidence linking him to intrusions against U.S. healthcare providers, including SSM Health Care Corporation and Sutter Health. Authorities seized multiple devices, including one containing a screenshot of access to TfL's network. Jubair was also found to have accessed TfL systems during the attack, with both individuals communicating through Telegram and collaborating in an online workspace.
Both Jubair and Flowers pleaded guilty to conspiring to commit unauthorized acts against TfL under the Computer Misuse Act, marking only the second criminal prosecution of its kind in the UK. The NCA noted that the charges fell under the most serious section of the Act, which applies when unauthorized acts create a significant risk of serious damage.
The case is considered a major success for law enforcement against one of the most active cybercrime groups targeting large organizations. Despite the continued use of the Scattered Spider name into early 2026, UK authorities believe that the arrests of Jubair and Flowers effectively dismantled the core operations of the group. Microsoft corroborated this assessment, stating that the arrests significantly impaired the group's ability to conduct cyberattacks.
In a related development, Peter Stokes, 19, another alleged member of Scattered Spider, was extradited from Finland to the U.S. to face charges of hacking, fraud, and extortion. He is accused of participating in multiple cyberattacks, including a breach of a luxury jewelry retailer in 2025, where attackers allegedly demanded $8 million in cryptocurrency. Stokes was arrested in April on an Interpol Red Notice.
U.S. officials have indicated that Scattered Spider, also known as Octo Tempest, UNC3944, and 0ktapus, has caused significant disruption by targeting American companies, stealing data, and demanding cryptocurrency payments. The FBI has warned that the group has cost businesses millions and disrupted critical operations. Authorities are committed to collaborating with international partners to identify and prosecute members of the group, regardless of their location.
Scattered Spider is part of a broader cybercriminal community known as "The Com," where hackers share information about high-profile cyber thefts, often initiated through social engineering tactics. In April 2026, Tyler Buchanan, 24, also linked to Scattered Spider, admitted in a U.S. court to hacking numerous companies and stealing millions in cryptocurrency. He was arrested in Spain during an operation involving the FBI and Spanish police.
The ongoing investigations and prosecutions highlight the persistent threat posed by cybercriminals and the efforts of law enforcement to combat these activities effectively.
