Two members of the Scattered Spider hacking group were sentenced to five years and six months in prison on July 16, 2026, after pleading guilty to a cyberattack on Transport for London (TfL) that caused approximately £29 million (around $47 million) in losses.
Owen Flowers, 18, and Thalha Jubair, 20, carried out the attack against TfL in summer 2024, taking down the transit authority’s infrastructure — including its ticketing system and real-time train arrival information — for several weeks. Authorities said the two had such extensive access to TfL’s systems that they “could have shut out and shut down TfL completely” and held “the keys to the kingdom” to the company’s infrastructure.
The pair were arrested a year after the attack. The FBI had accused Jubair of involvement in attacks on more than 120 companies using social engineering tactics — a method that targets employees and individuals rather than computer systems directly.
The U.K. National Crime Agency (NCA) said the sentences represent a significant blow to Scattered Spider, a group it described as “the most significant cybercrime threat to the U.K. in recent years.” The group has been linked to high-profile attacks against casino operator MGM, airline WestJet, and cybersecurity firm Okta, among others.
“Through this investigation, we have severely disrupted that threat and brought key offenders to justice,” said Paul Foster, head of the NCA’s National Cyber Crime Unit.
The case highlights that major cybercrime threats do not always originate from well-funded state actors. Scattered Spider, like similar groups such as ShinyHunters, relies heavily on social engineering — exploiting human targets rather than technical vulnerabilities — making such attacks both effective and difficult to counter.
Source: TechCrunch