Teenage TfL hackers jailed for year after attack with scattered spiders

Two British men sentenced to 5 years and 6 months for 2024 cyber attack on Transport for London linked to Scattered Spider group
Police seized devices showing evidence of the TfL breach; Flowers was also in the middle of an attack on US healthcare firms SSM Health and Sutter Health at the time of the arrest
TfL reported $39 million in damages; The NCA says the sentencing effectively dismantled Scattered Spider, and Microsoft confirmed the arrests undermined the group’s operations

Two young men, one aged 20 and the other aged 18, have been jailed for five years and six months for their involvement in the 2024 cyber attack on Transport for London (TfL).

Thalha Jubair, from East London, and Owen Flowers, from Walsall, West Midlands, were arrested in 2025 on suspicion of being the leading members of Scattered Spider – a notorious hacking collective known for breaching dozens of businesses. Initial reports from various cyber security organizations claimed that the group consisted mostly of teenagers whose native language was English.

During the arrest, police seized various types of electronic equipment from the suspects, including laptops, PCs, smartphones, hard drives, removable storage and more. On one of the computers, law enforcement found screenshots and videos showing the intrusion into TfL’s systems.

Millions in damages

To make matters worse, Flowers was in the middle of breaking into US healthcare companies SSM Health Care Corporation and Sutter Health when he was arrested: according to the National Crime Agency (NCA), these two were already “infiltrated and damaged”.

The attack on TfL was one of the more disturbing incidents of that year, and one which also caused a lot of financial damage. According to a report TfL shared with the City of London Police (CoLP), it suffered around $39 million in losses and recovery costs.

Both Jubair and Flowers initially pleaded not guilty and changed their pleas to guilty on the day they were due in court, it was said. Now they have both been sentenced to more than five years in prison. The NCA says these arrests and sentencing effectively dismantled the notorious hacking collective.

“While other cybercriminals may continue to use the damaged Scattered Spider brand, the NCA’s action against Jubair and Flowers effectively halted the group’s criminal activity,” the NCA said in its report.

“Independent assessment supports this, with Microsoft confirming that the arrests significantly impaired the group’s ability to continue conducting cybercriminal operations.”