Two Scattered Spider Members Jailed in UK's Largest Ever Cybercrime Prosecution
Thalha Jubair and Owen Flowers each received five and a half years in prison for a 2024 attack on Transport for London that cost the city £29 million.
Key points
- Thalha Jubair, 20, and Owen Flowers, 18, were each sentenced to five years and six months in prison on Thursday in the UK.
- Their 2024 cyberattack on Transport for London cost the public transport authority £29 million (roughly $39 million) to clean up.
- UK officials called it "the largest cybercrime prosecution ever brought before the UK courts".
- Microsoft confirmed to the NCA that the arrests materially degraded Scattered Spider's ability to operate.
- Peter Stokes, 19, was recently extradited to the United States to face separate charges.
Two young British men belonging to Scattered Spider were jailed Thursday after a judge handed each of them five years and six months. Thalha Jubair, 20, and Owen Flowers, 18, had pleaded guilty when their trial opened in June, reversing earlier not-guilty pleas. We covered that reversal on 23 June, when both men also admitted roles in a SIM-swap and SMS-phishing operation that turned harvested credentials into nine-figure ransom payouts.
Scattered Spider is a loosely organised criminal group that operates through online chat platforms, specialising in tricking employees into surrendering login details, then using those details to breach corporate systems and demand payment. The pair were convicted over a 2024 attack on Transport for London, the public body running the capital's buses and underground trains. The breach forced TfL to shut down staff and customer systems, triggering a recovery effort that cost £29 million.
Both men were arrested in September 2025. The NCA described the case as "the largest cybercrime prosecution ever brought before the UK courts".
Should Londoners who use TfL be worried?
The immediate threat from this attack is over. TfL has had more than a year to rebuild, and the two men convicted are now behind bars. If you used TfL services in late 2024, check whether you received a data notification from TfL and watch your bank statements for anything irregular.
The NCA said Thursday's sentences "effectively halted the group's criminal activity", adding that Microsoft independently confirmed the arrests materially degraded the group's operational capacity. That assessment needs context. Despite several arrests in 2025, hackers using the Scattered Spider name kept claiming attacks into early 2026; none have been publicly announced in recent months.
Prosecutions of other alleged members continue on both sides of the Atlantic. Tyler Buchanan, a British national believed to be part of the group, pleaded guilty in a US court in April, as first reported by SecurityWeek. Peter Stokes, 19, a dual US-Estonian national, was extradited from Finland to face charges in Chicago, as we reported on 1 July.
What matters most here is the sentence length. Five and a half years for teenagers is stiff by UK standards, and judges don't hand that down without intending to send a message to the wider ecosystem of young recruits these groups depend on.
