Two Scattered Spider Hackers Get 5.5 Years Each For £29 Million TfL Hack
Owen’s Flowers18, again Thalha Jubair20, were each sentenced to five and a half years at Woolwich Crown Court on Thursday, 16 July 2026, for the 2024 London Transport robbery.
The attack left 148 TfL systems inoperable and forced all of the transport authority’s 27,000 staff to go into the office to retrieve their passwords in person. Both the NCA and CPS put TfL’s losses and recovery costs at £29 million.
Both pleaded guilty on June 22, 2026, the date the trial was supposed to begin. The charge was Section 3ZA of the Computer Misuse Act 1990, the most serious of the Act, and they pleaded guilty on the basis that they were negligent in causing or causing a serious risk of serious harm to public welfare.
The CPS says Flowers and Jubair are believed to be the first hackers to be successfully prosecuted under Section 3ZA. The NCA lists the case as only the second such prosecution. These two courses can coexist, one counts the crimes filed under the category and the other counts those who end up being convicted, but neither institution explains the gap.
The NCA is calling it the biggest cybercrime prosecution ever seen by UK courts.
The intervention started on 31 August until 3 September 2024. TfL oversees an average of 9 million journeys per day. Dial-a-Ride, the booking service that connects vulnerable Londoners across the city, has gone down, along with a digital payment terminal and the issuance of concession travel cards.
Applications are now closed for Oyster photo cards, discounted cards for London’s children and young people. The contactless ticketing extension was smooth, and refunds were clear.
TfL told customers that names and email addresses had been accessed, as well as home addresses where they were stored. Oyster recovery data may also be gone, including bank account numbers and social security codes for about 5,000 people.
Only the two knew what they intended to do with the access, CPS said, although their interviews suggested they would revoke the access when they left. This is where the big number of the case comes in: the NCA says that a successful shutdown of the network could cost the UK economy up to £56 billion, while the CPS puts the same view in the billions. It’s always thinking, says the CPS, because TfL has pulled its network down to contain them.
Flower was arrested at his home on 6 September 2024, three days after the TfL raid, and the NCA says police found him attacking two US healthcare organisations, SSM Health Care Corporation and Sutter Health.
Investigators seized cell phones, tower computers, hard drives, and USB sticks. One laptop held a screenshot of TfL’s network connection and infrastructure, as well as videos Flowers had recorded of Jubair walking through TfL’s systems during the attack. The two were messaging on Telegram when it happened and shared an online workspace.
Prosecutors testified that Flowers was connected to a remote server used to launch all three crimes, and that his devices connected him to all three. Information linking Jubair to TfL was found overseas, helped by prosecutors there.
Flowers pleaded guilty to two counts of assault on health care, conspiracy to attack SSM Health, and conspiracy to attack Sutter Health. CPS says it has threatened to close those programs while admitting in interviews that “it could kill a 90-year-old person on life support.” Arrest is what stopped him.
The NCA describes both men as key members of the Scattered Spider, a pirate crew also tracked as Octo Tempest, UNC3944, and 0ktapus. The CPS has been more thorough, saying the defendants are said at various points to be members of a group that prosecutors believe carried out hundreds of attacks between 2022 and 2025.
The FBI, quoted in the NCA announcement, ties the group to data extortion, SIM swapping, and social engineering.
Jubair’s other case is still open
An indictment unsealed in New Jersey in September 2025 accuses Jubair of computer fraud, wire fraud, and money laundering schemes. The complaint alleges that the program involved approximately 120 network entries and at least 47 American victims between May 2022 and September 2025, for which more than $115 million was paid.
Prosecutors also implicated him in hacking a US critical infrastructure company and US courts, and said he withdrew an estimated $8.4 million in cash from a server wallet when agents seized it. Those are allegations, they have not been tested in court. The maximum for all calculations is 95 years. The announcement by the DOJ or the UK on Thursday that issued the release speech.
Is Scattered Spider finished?
The NCA says its action against the two men has effectively stopped the group, and cites Microsoft’s assessment that the arrests have reduced the group’s ability to operate. At the same time, it allows other criminals to continue using this product.
The Scattered Spider isn’t the only species with life left in it. In January, Mandiant tracked the expansion of a phishing scam named ShinyHunters that uses the same type of social engineering: vishing calls to employees, harvesting pages with the victim’s name to capture SSO logins and MFA codes, then the attacker’s device signing up for MFA.
Neither the NCA nor the CPS documents set out how Flowers and Jubair first came into contact with TfL. Google’s strong guidance from the same study puts the fix in one place: verify your identity in password resets, device registration, and MFA changes, a workflow that these employees call and talk about in their own way.
Paul Foster, head of the NCA’s National Cyber Crime Unit, wants one thing from everyone: call the law enforcement early. He says the convictions may not have happened if TfL had not acted.
The City of London Police have used this sentence to invoke powers they do not have. Cyber Crime Risk Orders can allow a court to restrict an individual’s equipment, internet services and technology in proportion to the risk they pose.
Commander Ollie Shaw has set them up as a “digital prison” for criminals. So the set of tools was what it was: a prison sentence, this time given to two people who were 17 and 18 when they did it.
