Attack and impact
Two leading members of the Scattered Spider cybercrime group, twenty-year-old Thalha Jubair and eighteen-year-old Owen Flowers, have been sentenced to five and a half years in prison for the August 2024 attack on Transport for London (TfL). TfL, which serves more than 8.4 million London residents, announced on 2 September 2024 that its network had been compromised in August. The intrusion disrupted internal systems and online services, including the Dial-a-Ride service, concessionary travel cards, digital payments and contactless ticketing. A total of 148 systems were affected, preventing refund processing and forcing all 27 thousand TfL employees to reset their passwords in person. According to Bleeping Computer, TfL’s losses reached 29 million pounds, while authorities estimated that a complete transport network outage could have cost the United Kingdom up to 56 billion pounds. On 12 September 2024 TfL confirmed that the attackers had exfiltrated data belonging to 148 thousand customers, including names, addresses and contact details.
Arrest and prosecution
Four days later, on 16 September 2024, officers from the City of London Police and the National Crime Agency (NCA) arrested Jubair and Flowers at their homes. Bleeping Computer reports that at the time of his arrest Flowers was also attempting to attack the US healthcare providers Sutter Health and SSM Health Care Corporation, and that evidence of the TfL intrusion was found on his devices. Both defendants pleaded guilty in June 2026 under the Computer Misuse Act and were sentenced on 16 July 2026 at Woolwich Crown Court. The judge, Mr Justice Turner, took account of their youth and neurodiversity but emphasised the sophistication of the attack, the scale of its impact on TfL, the significant planning involved and the fact that both knew their actions were criminal. The judge also noted that the age difference of one year and four months between Jubair and Flowers could represent a meaningful difference in maturity. The court granted a fifteen percent reduction in sentence for their guilty pleas. According to The Register, this is only the second sentencing in UK history under section 3ZA of the Computer Misuse Act, which covers the most serious offences. The previous section 3ZA conviction was a former GCHQ intern who received six years in prison.
Law enforcement response
The NCA described Scattered Spider as the most significant cyber threat to the United Kingdom in recent years. Paul Foster, the NCA’s deputy director, stated that the conviction would not have been possible without TfL’s timely cooperation with law enforcement and urged other organisations to follow the same approach. In July 2025 the NCA arrested four further suspected Scattered Spider members linked to attacks on major British retailers including Harrods, Marks & Spencer and Co-op.
Additional charges and wider context
Beyond the UK case, Jubair faces charges in the United States for conspiracy to commit computer fraud, money laundering and wire fraud in connection with at least 120 attacks between May 2022 and September 2025. Court documents cited by Bleeping Computer indicate those attacks hit dozens of US organisations, including critical infrastructure entities and courts, and that Jubair and his accomplices extorted victims worldwide, obtaining over 115 million dollars. Andy Lord, London’s Transport Commissioner, said that the security of TfL’s systems and customer data remains paramount and that the organisation continuously monitors its systems to prevent unauthorised access.
Implications
The convictions demonstrate the growing ability of law enforcement to identify and prosecute members of sophisticated cybercrime groups. For organisations, the case underscores the necessity of early cooperation with authorities during cyber incidents and the importance of strengthening critical infrastructure protection, including monitoring and preventing the social engineering attacks that Scattered Spider routinely employs.