Two teenage hackers, Thalha Jubair, 20, and Owen Flowers, 18, have been sentenced to five years and six months in prison for their roles in significant cyberattacks, including a four-day disruption of Transport for London (TfL) services. The duo, described as core members of the notorious 'Scattered Spider' network, were apprehended after Jubair made a critical error by purchasing gift vouchers for a food delivery service using a cryptocurrency wallet containing approximately £27 million in alleged ransom payments from major U.S. companies.
The FBI traced these purchases back to Jubair, revealing that one of Britain's most prolific cybercriminals was a 17-year-old living with his parents. This discovery led the National Crime Agency to launch an extensive investigation into their activities.
Scattered Spider has been linked to numerous high-profile attacks, including an estimated £1.9 billion loss for Jaguar Land Rover, a £300 million hack of M&S, and attacks on Harrods and Coop resulting in £206 million in losses. US prosecutors estimate Jubair handled around £200 million in cryptocurrency from ransoming businesses since he began hacking at age 13. He also allegedly hacked the US federal court system.
TfL Attack Details
The attack on TfL, which occurred in September 2024, disrupted services for months, affected the personal data of millions, and required all 28,000 TfL employees to reset their passwords. The booking system for Dial-a-Ride buses, used by people with disabilities, was shut down, and real-time travel information for apps like TfL Go and Citymapper was taken offline. While buses and tubes remained operational, the breach impacted key features of the TfL Go app and the TfL website. The hackers reportedly hunted for celebrity TfL users but were unable to access credit card details.
Criminal History and Modus Operandi
Jubair, who was groomed into hacking from a young age, has a history of cybercrimes, including 22 prior convictions for offenses such as blackmail, fraud, and stalking. He received a youth rehabilitation order in 2023 for these offenses but continued to target major corporations. His early exploits included SIM-swapping and infiltrating systems of entities like the City of London Police. He was described by prosecutors as an 'Artful Dodger' figure who recruited and trained other young hackers.
Flowers, who was 17 at the time of the TfL offense and had no prior convictions, was apprehended while hacking two U.S. healthcare companies from his bedroom. Even while on remand, Flowers reportedly used a smuggled phone to attempt hacks on entities including the Crown Prosecution Service, the Ministry of Justice, and government domains. He is alleged to have received £450,000 in Bitcoin while in prison, intending to launder it to pay drug debts.
Mr. Justice Turner, sentencing the pair, noted their actions were motivated by "selfish bravado, heedless of the severe consequences to others." He remarked on Jubair's "level of persistence undeterred by police intervention and court appearances," while acknowledging Flowers' youth. The judge also stated, "There's no Fagin in this case, it's a Fagin-less crime."