Two teenagers responsible for a cyber-hacking spree that cost millions and disrupted Transport for London (TfL) have been sentenced to five years and six months in prison. Thalha Jubair, 20, and Owen Flowers, 18, were key members of the notorious Scattered Spider network, known for targeting major corporations globally.
Jubair now faces extradition to the United States to face more serious charges. He has been indicted in New Jersey for allegedly extorting at least $100 million (£87 million) from 47 American companies and organizations between 2022 and 2025. Court documents indicate Jubair may have infiltrated the US federal court system by impersonating a judge to access email accounts.
The pair's actions, described by a judge as motivated by "selfish bravado, heedless of the severe consequences to others," led to a four-day cyberattack on TfL in 2024. Prosecutors stated this attack resulted in a £39 million loss and threatened to cause up to £56 billion in catastrophic damage had TfL's network not been disconnected.
Jubair, who began hacking at age 13 and by 15 had infiltrated City of London Police systems, was traced to his family home in east London. His downfall reportedly came after he used a cryptocurrency wallet containing £27 million in ransom money to purchase gift vouchers for a food delivery service. The spending trail led the FBI to his location.
Flowers was apprehended at his grandmother's home in Walsall, West Midlands. The UK's National Crime Agency (NCA) described the TfL investigation as its largest ever cybercrime prosecution. Paul Foster, head of the NCA's National Cyber Crime Unit, stated that the operation had significantly disrupted the threat posed by Scattered Spider.
Scattered Spider has been linked to several high-profile hacks, including an attack on Jaguar Land Rover estimated to have cost £1.9 billion, a £300 million hack on M&S, and breaches affecting Harrods and the Co-op, resulting in losses of £206 million.
Court documents revealed that $10 million (£7.5 million) was moved from Jubair's crypto wallets after his release from custody in March of the previous year, and that $200 million (£150 million) worth of cryptocurrency had passed through accounts linked to him. Flowers reportedly held $7.1 million (£5.3 million) in accounts under his control.
In 2023, Jubair was convicted of 22 offenses, including blackmail, fraud, and stalking, receiving an 18-month youth rehabilitation order. Despite this, he continued his illicit activities, including vowing to "f*** the railways" and "nuke access" after compromising an employee's account to hack into TfL's systems. The TfL breach impacted millions of people's personal data and required 28,000 employees to reset their passwords.