Two teenage members of the Scattered Spider hacking group were sentenced to five and a half years in prison on Wednesday for a 2024 cyber attack on Transport for London that cost the agency £39 million and exposed the data of roughly 7 million people.
Thalha Jubair, 20, and Owen Flowers, 18, tricked a TfL help desk into resetting authentication credentials during the August–September 2024 intrusion, disrupting live arrival information and contactless payments and forcing tens of thousands of staff to reset passwords in person. Flowers, from Walsall, also pleaded guilty to targeting US healthcare providers SSM Health Care Corporation and Sutter Health. Both defendants have been diagnosed with autism.
Prosecutors said the pair communicated via Telegram and shared an online workspace, with Flowers livestreaming while Jubair carried out the intrusion. Sentencing took place at Woolwich Crown Court.