Two arrested in ‘UK’s biggest ever cyber crime case’

Two young members of the hacking group Scattered Spider have been sentenced for a major cyber attack on Transport for London (TfL) that cost the organisation tens of millions of dollars and disrupted services.

Thalha Jubair, 20, from East London, and Owen Flowers, 18, from Walsall, West Midlands, were jailed for five years and six months each at Woolwich Crown Court on Thursday.

The pair carried out a multi-day intrusion into TfL’s network between 31 August and 3 September 2024. They livestreamed parts of the hack, gained high-level access to systems, and accessed data from the Oyster refund system while delaying contactless payments and other services.

TfL was forced to disconnect systems from the internet to prevent further damage, requiring all 27,000 employees to reset passwords in person and causing widespread disruption.

The prosecution described the attack as “extremely serious,” noting the hackers could have caused “catastrophic damage” but were stopped by TfL’s swift response. Total losses and recovery costs were reported at $37.7 million, plus $13 million in lost income.

The National Crime Agency (NCA) and City of London Police described it as the UK’s largest cyber crime prosecution. The FBI also praised the investigation.

The defendants were arrested in September 2024. Jubair had previous hacking convictions, while Flowers was also linked to attempted hacks on US healthcare systems.