Two Scattered Spider hackers jailed for £39 million TfL cyber-attack

Thalha Jubair, 20, and Owen Flowers, 19, were each sentenced to five and a half years at the Old Bailey on July 16, 2026, for the 2024 Transport for London cyber-attack. They stole data on millions of commuters, searched customer records for celebrities, and forced 27,000 staff to reset passwords. The breach cost TfL £39 million. The NCA says the convictions have "effectively halted" Scattered Spider's activity, though the collective's loose structure raises questions about that claim.