Two Scattered Spider Hackers Sentenced to Prison Over Major TfL Cyberattack

Two members of the Scattered Spider cybercrime group have been sentenced to prison in the United Kingdom for their involvement in a major cyberattack on Transport for London (TfL).

The UK’s National Crime Agency (NCA) announced that Thalha Jubair, 20, and Owen Flowers, 18, were convicted for their role in the 2024 attack, which caused widespread disruption to TfL services and resulted in an estimated £29 million ($39 million) in damages and recovery costs.

The pair were arrested in September 2025 and initially pleaded not guilty. However, they changed their pleas to guilty when their trial began in June 2026.

A UK court sentenced both men to five years and six months in prison. Officials described the case as the largest cybercrime prosecution ever brought before UK courts.

Although several Scattered Spider members were arrested in previous operations, hackers using the group’s name continued to claim responsibility for cyberattacks during the early months of 2026. However, no new attacks have been publicly announced in recent months.

Following the sentencing, the NCA stated that the arrests of Jubair and Flowers effectively disrupted the group’s criminal operations. The agency added that while others may continue using the Scattered Spider name, independent assessments, including findings from Microsoft, indicate that the arrests significantly reduced the group’s ability to carry out further cybercrime activities.