# Two Scattered Spider Leaders Jailed for £29M Transport for London (TfL) Cyberattack

> Thalha Jubair, 20, and Owen Flowers, 18, both leading members of the Scattered Spider cybercrime group, were sentenced to five years and six months each at Woolwich Crown Court on 16 July 2026 under Section 3ZA of the UK Computer Misuse Act 1990 for the 31 August–3 September 2024 attack on Transport for London that compromised 148 systems, exposed up to 7 million customer records, and cost TfL an estimated £29 million.

- **Published:** 2026-07-17T00:00:00Z
- **Last reviewed:** 2026-07-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1429
- **ID:** TL-2026-1429
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** RESOLVED
- **Actor:** Scattered Spider
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 16 July 2026, Woolwich Crown Court sentenced Thalha Jubair (20, of Bow, East London) and Owen Flowers (18, of Walsall) to five years and six months' imprisonment each for their roles in the August-September 2024 cyberattack on Transport for London (TfL), one of the largest transit authorities in the world. Both pleaded guilty on the first day of their trial, 22-23 June 2026, receiving a 15% sentence reduction. The charge — conspiracy to commit unauthorized acts against TfL computer systems with recklessness as to whether the acts would cause serious damage to human welfare — was brought under Section 3ZA of the Computer Misuse Act 1990, a provision reserved for the most severe offenses and only the second (per the NCA) or first (per the CPS) conviction secured under it in UK legal history. The National Crime Agency (NCA) described the case as the largest cybercrime prosecution ever brought before UK courts.

Jubair and Flowers were both identified as leading members of Scattered Spider (aka UNC3944, Octo Tempest, Scatter Swine, 0ktapus, Storm-0875, Muddled Libra), a loosely affiliated, predominantly English-speaking cybercriminal collective of individuals aged roughly 16-25 known for social-engineering-driven intrusions, SIM swapping, and data extortion. The TfL intrusion began on 31 August 2024 when the pair used TfL employee credentials purchased on criminal forums, combined with a helpdesk vishing (voice phishing) call impersonating a TfL employee, to trigger a fraudulent 2FA/password reset and gain initial account access after several failed attempts. From there they escalated privileges and moved laterally into internal databases and infrastructure, ultimately touching 148 systems and accessing records that TfL initially told the public numbered around 5,000 people but which TfL and the NCA later confirmed reached approximately 7 million customer records (names, emails, home addresses, and for a subset of customers potentially bank account/sort-code details). The intrusion, including a roughly 16-hour livestreamed session in which the attackers navigated TfL's internal systems, forced all 27,000-28,000 TfL staff into in-person password resets, disabled online account logins and customer portals, halted new Oyster/photocard applications until 4 December 2024, delayed the contactless-payment rollout, disrupted Dial-a-Ride booking and concessionary travel-card services, and impaired Oyster refund processing — while core train and bus operations continued running. NCA investigators separately assessed that a full network shutdown scenario could have cost the UK economy up to £56 billion; the realized direct cost to TfL was approximately £29 million in remediation plus an estimated £10 million in lost revenue.

Both defendants were arrested on 16 September 2024 (Flowers was first arrested 6 September 2024 and later breached bail conditions twice, in October 2024 and May 2025, related to prohibited device use; Jubair separately faced a charge for refusing to provide device PINs/passwords to investigators). Digital forensics were central to the case: an Acer laptop seized from Flowers contained remote-infrastructure access logs, virtual-machine connection records, screenshots and videos documenting the TfL intrusion in progress, a cryptocurrency wallet used both to pay for attack infrastructure and for food deliveries, spreadsheets of partial TfL employee credentials, and artifacts linking Flowers to separate intrusions against US healthcare providers SSM Health Care Corporation (conspiracy) and Sutter Health (attempted attack) in September 2024 — in chat logs Flowers reportedly acknowledged the healthcare attacks could risk killing an at-risk patient. Jubair and Flowers communicated over Telegram via a shared online workspace during the operation.

Both defendants have extensive prior involvement in the Scattered Spider/Lapsus$ ecosystem. Jubair, online as "Rocket Ace" and (at age 15) "Everlynn," was previously convicted in 2023 as a member of the Lapsus$ crew for the BT/EE and Nvidia breaches, sold fraudulent Emergency Data Requests using compromised government email addresses, and co-administered "Star Chat," a Telegram-based SIM-swapping service that used voice- and SMS-based phishing to steal employee credentials at major US and UK wireless carriers and redirect victim phone numbers to attacker-controlled devices. He also participated in a summer 2022 SMS phishing campaign against more than 130 organizations including LastPass, DoorDash, Mailchimp, Plex, and Signal, netting at least $8 million in stolen cryptocurrency, and has 22 prior UK convictions (13 fraud-related, 1 blackmail). In September 2025 US federal prosecutors in New Jersey unsealed a criminal complaint against Jubair alleging participation in roughly 120 network intrusions against 47+ US entities between May 2022 and September 2025 — including critical national infrastructure and a federal court system — with victims paying at least $115 million in ransoms; roughly $8.4 million in cryptocurrency was seized from a related server wallet. Jubair faces up to 95 years if convicted in the US and a pending US trial follows his UK sentence. Flowers, online as "Bo764," previously gave anonymous media interviews after the September 2023 MGM Resorts and Caesars Entertainment ransomware/social-engineering attacks (also attributed to Scattered Spider, with ALPHV/BlackCat ransomware deployment in the MGM incident) and had received a police cease-and-desist warning in October 2023 for prior lower-level computer offenses before the TfL attack. Both defendants are documented as neurodivergent (autism; Jubair also with depression and a severe mood disorder).

NCA Deputy Director Paul Foster called Scattered Spider "the most significant cybercrime threat to the UK in recent years" and stated the investigation was more complex than Operation Chronos, the LockBit ransomware takedown; the agency and Microsoft both assessed that the arrests and prosecution have measurably degraded the group's operational capability, though Scattered Spider/Octo Tempest/UNC3944 activity by other affiliated actors continues to be tracked via the CISA/FBI joint advisory AA23-320A (most recently updated July 2025) and MITRE ATT&CK Group G1015. This threat record documents the sentencing outcome and consolidates the confirmed TTPs and technical/legal facts of the TfL intrusion together with the actor's documented broader tradecraft as tracked by CISA and MITRE ATT&CK.

## MITRE ATT&CK

- T1589.001 Credentials
- T1598.004 Spearphishing Voice
- T1588.002 Tool
- T1566.004 Spearphishing Voice
- T1133 External Remote Services
- T1204 User Execution
- T1098 Account Manipulation
- T1556.006 Multi-Factor Authentication
- T1078.004 Cloud Accounts
- T1068 Exploitation for Privilege Escalation
- T1036 Masquerading
- T1070.008 Clear Mailbox Data
- T1621 Multi-Factor Authentication Request Generation
- T1552.001 Credentials In Files
- T1003 OS Credential Dumping
- T1003.006 DCSync
- T1087.002 Domain Account
- T1083 File and Directory Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1570 Lateral Tool Transfer
- T1213.002 Sharepoint
- T1113 Screen Capture
- T1074 Data Staged
- T1567.002 Exfiltration to Cloud Storage
- T1020 Automated Exfiltration
- T1219.002 Remote Desktop Software
- T1090 Proxy
- T1071.001 Web Protocols
- T1657 Financial Theft
- T1485 Data Destruction
- T1451 SIM Card Swap

## Sources

- [Two Scattered Spider Hackers Jailed](https://cybersecuritynews.com/two-scattered-spider-hackers-jailed/)
- [Brit Scattered Spider duo handed tickets to prison over Transport for London attack](https://www.theregister.com/cyber-crime/2026/07/16/brit-scattered-spider-duo-handed-tickets-to-prison-over-transport-for-london-attack/5272446)
- [Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack](https://thehackernews.com/2026/07/two-scattered-spider-hackers-get-55.html)
- [Scattered Spider Hackers Plead Guilty on Day 1 of Trial](https://krebsonsecurity.com/2026/06/scattered-spider-hackers-plead-guilty-on-day-1-of-trial/)
- [Scattered Spider members jailed over Transport for London hack that cost £29 million](https://www.helpnetsecurity.com/2026/07/16/ransport-for-london-cyberattack-prison-time/)
- [Scattered Spider Members Jailed for Disrupting London's Transport Systems](https://www.newshub.co.uk/news/2026/07/16/scattered-spider-members-jailed-for-disrupting-londons-transport-systems/)
- [UK cops say arrest of two young hackers disrupted the operations of an infamous hacking group](https://techcrunch.com/2026/07/16/uk-cops-say-arrest-of-two-young-hackers-disrupted-the-operations-of-an-infamous-hacking-group/)
- [Two Scattered Spider Hackers Sentenced to Jail in UK](https://www.securityweek.com/two-scattered-spider-hackers-sentenced-to-jail-in-uk/)
- [Scattered Spider hackers sentenced over TfL attack](https://www.computerweekly.com/news/366645859/Scattered-Spider-hackers-sentenced-over-TfL-attack)
- [Scattered Spider, Roasted 0ktapus, Octo Tempest, Storm-0875, UNC3944 (Group G1015)](https://attack.mitre.org/groups/G1015/)
- [CISA/FBI Advisory AA23-320A: Scattered Spider](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1429