Two members of the notorious Scattered Spider cybercrime group have been sentenced to five and a half years in prison each at Woolwich Crown Court for the 2024 cyberattack on Transport for London (TfL). Owen Flowers, 18, and Thalha Jubair, 20, pleaded guilty on the first day of their trial.
The attack left 148 TfL systems inoperable and forced all 27,000 of the transport authority’s employees to attend in-person to get their passwords reset. TfL’s losses and recovery costs exceeded 29 million pounds. The duo were key members of Scattered Spider, a prolific cybercrime group that US prosecutors say extorted dozens of companies.
The sentencing marks one of the largest cybercrime convictions in UK history. Scattered Spider gained notoriety for its sophisticated social engineering attacks, SIM-swapping operations, and ransomware campaigns targeting major corporations including Caesars Entertainment and MGM Resorts in 2023.
The case highlights the growing effectiveness of international law enforcement cooperation in pursuing cybercriminals. The UK National Crime Agency worked closely with US and European partners to identify and apprehend the suspects. As reported by Krebs on Security and The Hacker News, the sentences send a strong signal that cybercriminals face serious consequences regardless of their age.
