On 16 July 2026, Woolwich Crown Court sentenced Thalha Jubair (20, of Bow, East London) and Owen Flowers (18, of Walsall) to five years and six months' imprisonment each for their roles in the August-September 2024 cyberattack on Transport for London (TfL), one of the largest transit authorities in the world. Both pleaded guilty on the first day of their trial, 22-23 June 2026, receiving a 15% sentence reduction. The charge — conspiracy to commit unauthorized acts against TfL computer systems with recklessness as to whether the acts would cause serious damage to human welfare — was brought under Section 3ZA of the Computer Misuse Act 1990, a provision reserved for the most severe offenses and only the second (per the NCA) or first (per the CPS) conviction secured under it in UK legal history. The National Crime Agency (NCA) described the case as the largest cybercrime prosecution ever brought before UK courts.

Jubair and Flowers were both identified as leading members of Scattered Spider (aka UNC3944, Octo Tempest, Scatter Swine, 0ktapus, Storm-0875, Muddled Libra), a loosely affiliated, predominantly English-speaking cybercriminal collective of individuals aged roughly 16-25 known for social-engineering-driven intrusions, SIM swapping, and data extortion. The TfL intrusion began on 31 August 2024 when the pair used TfL employee credentials purchased on criminal forums, combined with a helpdesk vishing (voice phishing) call impersonating a TfL employee, to trigger a fraudulent 2FA/password reset and gain initial account access after several failed attempts. From there they escalated privileges and moved laterally into internal databases and infrastructure, ultimately touching 148 systems and accessing records that TfL initially told the public numbered around 5,000 people but which TfL and the NCA later confirmed reached approximately 7 million customer records (names, emails, home addresses, and for a subset of customers potentially bank account/sort-code details). The intrusion, including a roughly 16-hour livestreamed session in which the attackers navigated TfL's internal systems, forced all 27,000-28,000 TfL staff into in-person password resets, disabled online account logins and customer portals, halted new Oyster/photocard applications until 4 December 2024, delayed the contactless-payment rollout, disrupted Dial-a-Ride booking and concessionary travel-card services, and impaired Oyster refund processing — while core train and bus operations continued running. NCA investigators separately assessed that a full network shutdown scenario could have cost the UK economy up to £56 billion; the realized direct cost to TfL was approximately £29 million in remediation plus an estimated £10 million in lost revenue.

Both defendants were arrested on 16 September 2024 (Flowers was first arrested 6 September 2024 and later breached bail conditions twice, in October 2024 and May 2025, related to prohibited device use; Jubair separately faced a charge for refusing to provide device PINs/passwords to investigators). Digital forensics were central to the case: an Acer laptop seized from Flowers contained remote-infrastructure access logs, virtual-machine connection records, screenshots and videos documenting the TfL intrusion in progress, a cryptocurrency wallet used both to pay for attack infrastructure and for food deliveries, spreadsheets of partial TfL employee credentials, and artifacts linking Flowers to separate intrusions against US healthcare providers SSM Health Care Corporation (conspiracy) and Sutter Health (attempted attack) in September 2024 — in chat logs Flowers reportedly acknowledged the healthcare attacks could risk killing an at-risk patient. Jubair and Flowers communicated over Telegram via a shared online workspace during the operation.

Both defendants have extensive prior involvement in the Scattered Spider/Lapsus$ ecosystem. Jubair, online as "Rocket Ace" and (at age 15) "Everlynn," was previously convicted in 2023 as a member of the Lapsus$ crew for the BT/EE and Nvidia breaches, sold fraudulent Emergency Data Requests using compromised government email addresses, and co-administered "Star Chat," a Telegram-based SIM-swapping service that used voice- and SMS-based phishing to steal employee credentials at major US and UK wireless carriers and redirect victim phone numbers to attacker-controlled devices. He also participated in a summer 2022 SMS phishing campaign against more than 130 organizations including LastPass, DoorDash, Mailchimp, Plex, and Signal, netting at least $8 million in stolen cryptocurrency, and has 22 prior UK convictions (13 fraud-related, 1 blackmail). In September 2025 US federal prosecutors in New Jersey unsealed a criminal complaint against Jubair alleging participation in roughly 120 network intrusions against 47+ US entities between May 2022 and September 2025 — including critical national infrastructure and a federal court system — with victims paying at least $115 million in ransoms; roughly $8.4 million in cryptocurrency was seized from a related server wallet. Jubair faces up to 95 years if convicted in the US and a pending US trial follows his UK sentence. Flowers, online as "Bo764," previously gave anonymous media interviews after the September 2023 MGM Resorts and Caesars Entertainment ransomware/social-engineering attacks (also attributed to Scattered Spider, with ALPHV/BlackCat ransomware deployment in the MGM incident) and had received a police cease-and-desist warning in October 2023 for prior lower-level computer offenses before the TfL attack. Both defendants are documented as neurodivergent (autism; Jubair also with depression and a severe mood disorder).

NCA Deputy Director Paul Foster called Scattered Spider "the most significant cybercrime threat to the UK in recent years" and stated the investigation was more complex than Operation Chronos, the LockBit ransomware takedown; the agency and Microsoft both assessed that the arrests and prosecution have measurably degraded the group's operational capability, though Scattered Spider/Octo Tempest/UNC3944 activity by other affiliated actors continues to be tracked via the CISA/FBI joint advisory AA23-320A (most recently updated July 2025) and MITRE ATT&CK Group G1015. This threat record documents the sentencing outcome and consolidates the confirmed TTPs and technical/legal facts of the TfL intrusion together with the actor's documented broader tradecraft as tracked by CISA and MITRE ATT&CK.