Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court on July 16, 2026, for the 2024 hack of Transport for London (TfL). The attack left 148 TfL systems inoperable and forced all 27,000 employees to reset passwords in person. Losses and recovery costs totaled £29 million.
Both pleaded guilty on June 22, 2026, under Section 3ZA of the Computer Misuse Act 1990, the first successful prosecution under this section. The intrusion occurred from August 31 to September 3, 2024, disrupting Dial-a-Ride, digital payments, and Oyster photocards. Customer data including names, email addresses, and bank details for 5,000 people were accessed.
Flowers was arrested on September 6, 2024, while attacking two US healthcare organizations, SSM Health Care Corporation and Sutter Health. He admitted two additional counts related to those attacks. The National Crime Agency (NCA) described both as leading members of Scattered Spider (also tracked as Octo Tempest, UNC3944, 0ktapus).
Jubair faces separate US charges for computer fraud, wire fraud, and money laundering conspiracies involving 120 network intrusions and $115 million in ransoms. The NCA states the arrests effectively halted the group, though other criminals may continue using the brand.
Attack groups: Scattered Spider, Octo Tempest, UNC3944, 0ktapus, ShinyHunters
Companies: Transport for London, SSM Health Care Corporation, Sutter Health, National Crime Agency, Crown Prosecution Service, FBI, Mandiant, Microsoft, Google, City of London Police
Events: TfL Hack 2024, Woolwich Crown Court Sentencing 2026
Original source: thehackernews.com