Twenty‑year‑old Thalha Jubair and 18‑year‑old Owen Flowers received five years and six months behind bars for the 2024 cyberattack on Transport for London that caused £29 million in damages. The case is hailed as the largest cybercrime prosecution in UK history.

Key Takeaways

  • Thalha Jubair and Owen Flowers sentenced to 5 years 6 months.
  • Attack on Transport for London caused £29 million ($39 million) in losses.
  • Sentencing severely curtails Scattered Spider’s operational capacity.

The United Kingdom’s National Crime Agency (NCA) announced on Thursday that two members of the notorious Scattered Spider cyber‑crime gang – Thalha Jubair, 20 and Owen Flowers, 18 – have been handed prison terms after a high‑profile 2024 hack on Transport for London (TfL). The intrusion disrupted the city’s transit network and generated an estimated £29 million (≈ $39 million) in direct costs.

Arrest and Legal Journey

Both suspects were apprehended in September 2025. Initially pleading not guilty, they switched to guilty pleas when the trial commenced in June 2026. Prosecutors described the case as “the largest cybercrime prosecution ever brought before the UK courts,” underscoring its historic significance for law‑enforcement and cyber‑security policy.

Read Also:Weak Security Fuels Russian Cyber Attacks as UK and EU Impose Joint Sanctions

Sentencing Details and Immediate Impact

The court sentenced each defendant to five years and six months of incarceration. NCA officials hailed the verdict as a decisive blow against the Scattered Spider brand, noting that the punishment “effectively halted the group’s criminal activity.” Independent assessments, including a statement from Microsoft, confirmed that the arrests materially degraded the gang’s ability to conduct further operations.

Ongoing Threat Landscape

Despite a series of arrests in the previous year, actors still invoking the Scattered Spider name claimed responsibility for attacks into early 2026, though no new incidents have been publicly reported in recent months. The NCA indicated that investigations into other alleged members continue. Notably, 19‑year‑old Peter Stokes, a dual US‑Estonian national, was recently extradited to the United States for prosecution, while British national Tyler Buchanan pleaded guilty in a US court in April.

Broader Implications

The sentencing sends a strong deterrent signal to cyber‑criminals targeting critical public infrastructure. It also highlights the necessity for robust international cooperation, as the dismantling of a trans‑national hacking group requires coordinated legal actions across jurisdictions. Policymakers may now feel increased pressure to allocate more resources toward safeguarding essential services against sophisticated digital threats.