U.K. police announced that the jailing of Owen Flowers, 18, and Thalha Jubair, 20, has severely disrupted the operations of Scattered Spider, an infamous cybercrime group. The pair pleaded guilty earlier this year to hacking Transport for London (TfL) in 2024 and received sentences of five years and six months in prison. Authorities described Scattered Spider as the most significant cybercrime threat to the U.K. in recent years.
The summer 2024 attack on TfL took critical infrastructure offline, including the ticketing system and real-time train arrival information, with disruptions lasting for weeks. Losses totaled around £29 million. The hackers gained such deep access that they held the keys to the kingdom and could have completely shut down TfL systems.
Scattered Spider has been linked to dozens of high-profile attacks against targets including casino giant MGM, airline WestJet, and cybersecurity firm Okta, often using social engineering to exploit employees rather than technical vulnerabilities. The FBI previously accused Jubair of involvement in attacks on more than 120 companies. Paul Foster of the National Crime Agency said the investigation brought key offenders to justice and severely disrupted the threat.
The case underscores that some of the most effective hackers are young individuals motivated by money and peer infamy rather than state-sponsored actors with large budgets. While hacking groups can rebrand as members come and go, British authorities view the convictions as a major blow to Scattered Spider.