Teenage TfL hackers sentenced to years in prison after Scattered Spider attacks

Two Britons sentenced to 5 years and 6 months for the 2024 cyberattack on Transport for London, linked to the Scattered Spider group
Police confiscated devices showing evidence of the TfL breach; Flowers was also in the midst of an attack on American healthcare companies SSM Health and Sutter Health at the time of the arrest.
TfL reported $39 million in damage; The NCA says the ruling effectively dismantled Scattered Spider, and Microsoft confirmed that the arrests degraded the group’s operations.

Two young people, one aged 20 and the other aged 18, have been sentenced to five years and six months in prison for their involvement in the cyber attack on Transport for London (TfL) in 2024.

Thalha Jubair, from east London, and Owen Flowers, from Walsall, West Midlands, were arrested in 2025 on suspicion they were core members of Scattered Spider, an infamous hacking collective known for breaching dozens of companies. Initial reports from different cybersecurity organizations stated that the group was mainly made up of teenagers whose native language was English.

During the arrest, police confiscated different types of electronic equipment from the suspects, including laptops, PCs, smartphones, hard drives, removable storage devices and more. On one of the computers, authorities found screenshots and videos showing the intrusion into TfL’s systems.

Millions in damages

To make matters even worse, Flowers was about to break into US healthcare companies SSM Health Care Corporation and Sutter Health when he was arrested: according to the National Crime Agency (NCA), these two were already “infiltrated and damaged”.

The attack on TfL was one of the most disturbing incidents of that year and also caused a lot of financial damage. According to a report TfL shared with the City of London Police (CoLP), it suffered around $39 million in losses and recovery costs.

Both Jubair and Flowers initially pleaded not guilty and changed their pleas to guilty on the day they were due to stand trial, it was said. Now both are sentenced to more than five years in prison. The NCA says these arrests and sentences effectively dismantled the notorious hacking collective.

“Although other cybercriminals may continue to use the damaged Scattered Spider brand, the NCA’s action against Jubair and Flowers effectively stopped the group’s criminal activity,” the NCA said in its report.

“An independent assessment supports this, and Microsoft confirms that the arrests materially degraded the group’s ability to continue conducting cybercriminal operations.”