Two young members of the notorious Scattered Spider cybercrime network have been sentenced to five years and six months in prison after orchestrating a devastating cyberattack against Transport for London (TfL), a breach that disrupted services for months and exposed the personal data of millions of people.
Thalha Jubair, 20, and Owen Flowers, 18, admitted their roles in the September 2024 attack, which investigators said had the potential to inflict catastrophic financial damage before TfL isolated its systems to contain the breach.
Court Condemns “Reckless” Cyber Campaign
Delivering sentence at Woolwich Crown Court, Mr Justice Turner described the pair’s actions as reckless and driven by arrogance rather than necessity.
The judge concluded that both defendants had acted out of “selfish bravado,” showing little regard for the widespread disruption and financial consequences their hacking caused to businesses, public services and individuals.
Despite differences in their criminal histories, both received identical prison terms of five years and six months.
Flowers benefited from his age and lack of previous convictions, while Jubair’s extensive record of cyber offences reflected what the judge called a persistent pattern of offending despite repeated police intervention.
TfL Attack Triggered Months of Disruption
The attack on London’s transport network began after hackers gained access through the account of a single TfL employee.
Although trains and buses continued operating, the incident forced the transport authority to shut down parts of its digital infrastructure, leaving thousands of employees to reset passwords in person and disrupting several customer-facing services.
Among the most significant impacts were the suspension of the Dial-a-Ride booking platform for passengers with disabilities, the temporary removal of live transport information from apps including TfL Go and Citymapper, and the exposure of personal information belonging to millions of users.
Investigators also revealed that the hackers attempted to identify high-profile and celebrity TfL customers, although they were unable to access payment card information.
Investigation Uncovered Wider Criminal Enterprise
Authorities described the two defendants as key figures within Scattered Spider, a cybercrime collective linked to attacks on major corporations in Britain and abroad.
The group’s alleged victims include Jaguar Land Rover, Marks & Spencer, Harrods and the Co-op, with investigators estimating the combined financial impact of those breaches in the billions of pounds.
Prosecutors said the pair were involved in ransomware operations that targeted businesses internationally, generating tens of millions of pounds through extortion schemes.
Takeaway Purchases Led Investigators to Jubair
One of the most significant breakthroughs came after Jubair used cryptocurrency connected to alleged ransom proceeds to purchase food delivery vouchers.
Investigators traced the transactions to a wallet believed to contain approximately £27 million in cryptocurrency, allowing the FBI to identify the teenager’s home in Tower Hamlets, East London.
The discovery ultimately prompted the National Crime Agency to launch what became its largest cybercrime investigation.
Authorities said Jubair had allegedly handled around £200 million in cryptocurrency connected to ransomware activity, with U.S. prosecutors claiming he had been involved in cybercrime since the age of 13.
Defence Describes Troubled Online Childhood
Jubair’s defence argued that his path into cybercrime began during childhood after he was introduced to technology at an unusually young age.
His lawyer told the court the defendant received his first smartphone at four years old and began programming computers before turning 10.
According to the defence, he was recruited into hacking communities through online gaming platforms such as Roblox before progressing into increasingly sophisticated cyber offences.
Counsel portrayed him as an isolated teenager who sought recognition within online criminal communities after experiencing bullying and social exclusion, comparing his journey to a modern version of Charles Dickens’ Oliver Twist.
However, the judge rejected suggestions that another individual had masterminded the crimes, remarking that “there’s no Fagin in this case.”
Criminal Activity Expanded Before Adulthood
Evidence presented in court showed Jubair’s cybercriminal activities escalated rapidly throughout his teenage years.
He was linked to large-scale SIM-swapping operations targeting hundreds of victims, later joining hacking groups accused of attacking global technology companies including Microsoft, Nvidia, Samsung, Uber and T-Mobile.
Prosecutors also connected members of the group to the theft of confidential material from Rockstar Games, including unreleased content relating to Grand Theft Auto VI.
Despite being arrested while still wearing his school uniform and later receiving a youth rehabilitation order for multiple offences including fraud, blackmail and stalking, prosecutors said Jubair continued targeting major organisations.
U.S. authorities have additionally linked him to ransomware attacks involving more than $115 million in payments, including a major cyberattack against casinos in Las Vegas.
Flowers Continued Hacking While in Custody
Prosecutors told the court that Flowers continued attempting cyber intrusions even after his arrest.
While on remand, he allegedly used a smuggled mobile phone to target the Crown Prosecution Service, the Ministry of Justice, government computer systems and even the prison where he was being held.
Police arrested him at his grandmother’s home in Walsall while he was allegedly carrying out attacks against two American non-profit healthcare organisations.
Investigators also discovered that he received hundreds of thousands of pounds worth of Bitcoin while incarcerated, with evidence suggesting he intended to launder the cryptocurrency.
Messages recovered by investigators showed Flowers believed he would receive a much shorter prison sentence and had been studying criminal law and researching judges while awaiting trial.
International Cooperation Highlights Growing Cyber Threat
The investigation relied on close cooperation between British and American law enforcement agencies, with evidence gathered by the FBI, National Crime Agency and U.S. prosecutors.
Officials described the case as one of the most significant cybercrime prosecutions involving teenage offenders in Britain, highlighting the increasingly sophisticated capabilities of young hackers operating through international online networks.
What’s Next?
With both defendants now beginning prison sentences, investigators continue pursuing other members of the Scattered Spider network, which remains linked to numerous high-profile ransomware attacks worldwide.
The case is also expected to influence future cybersecurity policies, particularly around protecting critical public infrastructure and preventing young people from being recruited into organised cybercrime through online platforms.
Summary
Thalha Jubair and Owen Flowers have each been sentenced to five years and six months in prison for orchestrating the cyberattack on Transport for London that disrupted services and exposed sensitive data.
The investigation revealed the pair’s wider involvement in the Scattered Spider hacking group, with authorities uncovering years of global ransomware activity, continued offending after arrest, and a trail of cryptocurrency transactions that ultimately helped bring one of Britain’s most prolific young cybercriminals to justice.
