Owen Flowers, 18, and Thalha Jubair, 20, have each been sentenced to five years and six months in prison for a major cyber-attack against Transport for London (TfL). The pair, described as social loners obsessed with computing, operated as part of a collective known as Scattered Spider. Their 2024 digital assault, which was live-streamed, lasted 16 hours and compromised the personal information of nearly 10 million customers.
The breach forced TfL to disconnect systems to prevent further damage, resulting in the operational failure of 148 technology systems and an estimated financial cost of £29 million. By tricking a help desk employee into resetting a staff password, the hackers bypassed security protocols. Flowers and Jubair were later apprehended, with Flowers caught during an active attempt to compromise US healthcare providers. Authorities also seized roughly £1 million in cryptocurrency from the individuals.
Both men have histories of illicit online activity. Jubair, who holds 22 previous convictions, was formerly involved with the Lapsus$ hacking group. While their legal teams suggested the teens were influenced by older criminals or suffered from isolation, the National Crime Agency emphasized the growing threat posed by young hackers operating from their homes. Despite their incarceration, investigators noted that both defendants were found with unauthorized mobile devices while in custody, attempting to plan further cyber-attacks.
