Two Scattered Spider Hackers Jailed Over £29m TfL Attack
Thalha Jubair, 20, and Owen Flowers, 18, were each jailed for five years and six months after pleading guilty to a 2024 cyberattack on Transport for London that cost about £29 million.
Two members of the Scattered Spider cybercrime group, 20-year-old Thalha Jubair and 18-year-old Owen Flowers, were each sentenced to five years and six months in prison on Thursday after pleading guilty to roles in a 2024 cyberattack on Transport for London. Officials estimate the incident and the recovery effort cost about £29 million.
Both men were arrested in September 2025. They initially pleaded not guilty but changed their pleas to guilty when their trial began in June.
The National Crime Agency announced the sentences and described the case as the largest cybercrime prosecution to reach UK courts. In a statement the agency added: ‘Although other cybercriminals may continue to use the damaged Scattered Spider brand, the NCA’s action against Jubair and Flowers effectively halted the group’s criminal activity.’
Microsoft conducted an independent assessment and confirmed the arrests materially degraded the group’s ability to carry out cybercriminal operations.
Officials noted that individuals using the Scattered Spider name continued to claim responsibility for attacks into early 2026, but no new incidents have been publicly reported in recent months.
Investigations and prosecutions connected to the group are ongoing. Nineteen-year-old Peter Stokes, a dual US-Estonian national, was extradited to the United States to face charges. A British national, Tyler Buchanan, pleaded guilty in a US court in April for offences linked to the wider investigation.
UK and US law enforcement agencies are pursuing additional suspects and continue to coordinate on disrupting organised cybercrime linked to the Scattered Spider network.
Articles by this author
