Scattered Spider Members Sentenced for £29 Million TfL Cyberattack

Two members of the Scattered Spider cybercrime group, Owen Flowers (18) and Thalha Jubair (20), were sentenced to five and a half years in prison for their roles in a 2024 cyberattack on Transport for London (TfL). The attack caused significant financial harm, estimated at £29 million, and disrupted TfL operations. The sentencing, which took place on July 16, 2026, at Woolwich Crown Court, marks a significant moment in UK cybercrime prosecution history. Both defendants pleaded guilty in June 2026, receiving a 15% reduction in their sentences. The National Crime Agency (NCA) described Scattered Spider as a major cyber threat to the UK, responsible for multiple high-profile attacks. This case represents only the second conviction under Section 3ZA of the Computer Misuse Act 1990, highlighting the seriousness of their offenses. The judge noted the defendants' immaturity and neurodiversity while still emphasizing the sophistication and planning behind the attack.

Key Points: • Owen Flowers and Thalha Jubair received 5.5-year prison sentences for a TfL cyberattack. • The attack on Transport for London caused an estimated £29 million in damages. • This case is only the second conviction under Section 3ZA of the Computer Misuse Act 1990.