Two Scattered Spider hackers sent to prison over London attack
If the attackers got their way, damages could have reached $75 billion.
Image by Cybernews.
- Owen Flowers and Thalha Jubair received five-and-a-half-year prison sentences for the 2024 Transport for London cyberattack.
- The attack stole customer data and disrupted key services, including Dial-a-Ride for vulnerable London residents.
- Authorities said the incident cost TfL £29 million, while a full network shutdown could have cost £56 billion.
- The NCA called Scattered Spider the UK’s most significant recent cybercrime threat, citing harm to critical infrastructure.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Owen Flowers and Thalha Jubair, Scattered Spider hacker group members behind the attack on Transport for London (TfL), will spend years in prison. Authorities claim that the pair’s cyberattack cost $39 million (£29 million), but could have been way more expensive.
Thalha Jubair, 20, and Owen Flowers, 18, will spend a good chunk of their time behind bars. According to the UK’s National Crime Agency (NCA), the duo was sentenced to five years and six months each.
“Scattered Spider has been the most significant cybercrime threat to the UK in recent years. [...]. The attack on Transport for London caused significant financial harm and disruption to a vital part of the UK’s critical infrastructure,” Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said.
Flowers and Jubair attacked TfL in September of 2024. Customer data was stolen, including full names, contact details, postal addresses, Oyster card refund information, and user account information.
According to NCA, the attack disrupted numerous services on which London’s public transport system relies. One of the impacted services was the Dial-a-Ride booking service, which provides transport to vulnerable residents.
All 27,000 TfL employees had to physically come to the headquarters to reset passwords, further disrupting services. Authorities claim that the incident cost the organization $39 million (£29 million).
However, had the attackers successfully shut down the transport network of Europe’s second-largest city, the estimated costs of the attack could have reached $75 billion (£56 billion).
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Flowers and Jubair were promptly arrested by the Metropolitan police days after the attack. The duo, which belonged to the infamous Scattered Spider collective, pleaded guilty last month. Jubair already had a prior juvenile conviction for hacking with the Lapsus$ cybercrime gang.
According to a media report, Jubair exposed himself after he used some of the millions he'd extorted from global organizations on takeout orders from the bedroom of his parents’ East London council flat.
The wallet was hosted on the same server that he and his fellow hackers used to store tens of millions of dollars worth of bitcoin they’d taken in ransoms paid by major US companies.
In addition to buying food delivery vouchers, he allegedly made the mistake of topping up his gaming account using funds from the same server as the ransom proceeds.
Cybernews also reported that another teen, Peter Stokes, accused of being part of Scattered Spider, was extradited from Finland to the US and is now facing multiple federal hacking and fraud charges.
