British police have dealt a severe blow to the notorious Scattered Spider cybercrime syndicate after two young hackers were jailed in London on Thursday for a devastating 2024 cyberattack on Transport for London (TfL).
Owen Flowers, aged 18, and Thalha Jubair, aged 20, had pleaded guilty earlier this year to breaching the IT infrastructure of TfL, the government body responsible for the capital’s public transport network. On Thursday, the London court sentenced both defendants to five years and six months in prison.
A major disruption to global cybercrime
The prosecution of Flowers and Jubair highlights a growing trend in modern cyber warfare: the most disruptive threats often do not originate from state-sponsored agencies with multi-million-pound budgets. Instead, they are frequently launched by highly skilled, young individuals driven by financial gain and notoriety within the underground hacking community.
Syndicates like Scattered Spider and ShinyHunters have pioneered highly effective social engineering tactics. Rather than focusing solely on bypassing complex software security, these cybercriminals target human vulnerabilities, manipulating employees to gain access to secure corporate networks.
While cyber gangs frequently rebrand or swap members, British law enforcement officials are confident that removing Flowers and Jubair from operation has significantly crippled Scattered Spider. The amorphous group has previously been linked to high-profile network breaches targeting casino operator MGM, airline WestJet, and identity management firm Okta, exposing the data of millions of customers worldwide.
“Scattered Spider has been the most significant cybercrime threat to the UK in recent years. Through this investigation, we have severely disrupted that threat and brought key offenders to justice,” stated Paul Foster, Head of the National Cyber Crime Unit at the UK National Crime Agency (NCA).
Two young men have been sentenced for launching a cyber attack on Transport for London (TfL) which cost tens of millions of pounds in losses and inconvenienced thousands of customers.
Thalha Jubair and Owen Flowers were identified by the NCA and @CityPolice following the attack… pic.twitter.com/ZJdmdZhXRJ
— National Crime Agency (NCA) (@NCA_UK) July 16, 2026
How the TfL network was crippled
The cyberattack, executed during the summer of 2024, caused widespread disruption across London’s transport infrastructure. The breach forced TfL to take critical systems offline, disabling online ticketing platforms and halting real-time passenger arrival information feeds. The resulting system outages persisted for several weeks, causing severe delays for commuters.
var playerInstance_jwplayer_6a7a074fab10a = jwplayer( “jwplayer_6a7a074fab10a” );
playerInstance_jwplayer_6a7a074fab10a.setup({
playlist: “https://cdn.jwplayer.com/v2/media/lv0GaEwB”,
});
The “keys to the kingdom”
Following a year-long investigation, law enforcement officers arrested the duo. During the investigation, the FBI revealed that Jubair had been linked to social engineering attacks targeting more than 120 companies globally.
The financial impact on the UK capital was immense, with authorities estimating total losses at approximately £29 million (around $47 million). Investigators revealed that the hackers had secured such deep administrative access to the transport network’s infrastructure that they held “the keys to the kingdom” and possessed the technical capability to shut down London’s entire transport system, according to The Guardian.