Two British teenagers, Thalha Jubair, 20, and Owen Flowers, 18, have been sentenced to five years and six months in prison for a £29 million cyber-hacking spree. Their actions included a four-day attack on Transport for London (TfL) in 2024 that threatened catastrophic damage. Jubair now faces potential extradition to the United States over more serious charges, including allegations of extorting at least £87 million from 47 American companies and organizations between 2022 and 2025.
The pair were described by Judge Mark Turner as motivated by "selfish bravado, heedless of the severe consequences to others." They were core members of the Scattered Spider network, which has been linked to significant attacks on major companies. These include an estimated £1.9 billion attack on Jaguar Land Rover, a £300 million hack of M&S, and attacks on Harrods and the Co-op, resulting in losses of £206 million.
Jubair's undoing came when he used a cryptocurrency wallet containing £27 million to purchase gift vouchers for a food delivery service. Tracing these transactions led the FBI to his doorstep. He was identified as a 17-year-old autistic loner living with his parents in east London at the time of the hack. He had begun hacking at age 13 and, by 15, had infiltrated the City of London Police's systems. In 2023, he was convicted of 22 offenses, including blackmail and fraud, and received an 18-month youth rehabilitation order, but continued his criminal activities.
Flowers was arrested at his grandmother's home in Walsall, West Midlands, as part of the UK's National Crime Agency's (NCA) largest ever cyber-crime investigation into the TfL attack. The breach at TfL disrupted services for months, affected millions of people's personal data, and required 28,000 employees to reset their passwords.
Paul Foster, head of the NCA's National Cyber Crime Unit, stated that this case represents the largest cyber-crime prosecution brought before the UK courts. He added that the investigation has severely disrupted the threat posed by Scattered Spider, identified as the most significant cyber-crime threat to the UK in recent years, and brought key offenders to justice. Court files also allege that Jubair hacked the U.S. federal court system by impersonating a judge to gain access to email accounts. Prior to the TfL attack, Jubair vowed to "f*** the railways" and "nuk[e] access" after compromising an employee's account.