Scattered Spider hackers jailed over £29m TfL cyber attack

Two teenagers have been jailed for 11 years after a sophisticated hack that that paralysed Transport for London.

Thalha Jubair, 19, and Owen Flowers, 18, tricked the transport body’s IT helpdesk into resetting the passwords for the chief information sercurity officer.

They then infiltrated so deeply that they obtained the highest privileged access, known as ‘the keys to the kingdom’, costing TfL £29 million. Had the hack continued, the damage to the economy could have cost nearly £60 billion.

They stopped all contactless and Oyster payments, prevented live Tube info on TfL’s apps and website, and even viewed celebrities’ accounts.

Their hack only came to an end when TfL ‘pulled the plug’ on the entire system, resetting the passwords of all 27,000 staff.

Judge Mr Justice Spencer jailed each of them for five and a half years, saying that despite their relative youth and neurodiversity, the offending is ‘so serious that I have no alternative but to pass a sentence of immediate custody’.

He told them: ‘I am satisfied that your actions were primarily motivated by selfless bravado, heedless of the severe consequences for others.’

Flowers, who lived with his grandma in Walsall, and Jubair, of Bow, east London, were ‘leading members’ of the cyberhacking gang Scattered Spider.

The National Crime Agency (NCA) described the group as ‘the most significant cybercrime threat to the UK in recent years’.

Prosecutors said Scattered Spider are ‘believed to be responsible for hundreds of cyber attacks between 2022 and 2025’.

M&S was targeted by the hackers in April last year, with the retailer stopping all online sales for around six weeks and suffering empty shelves due to disruptions to its logistics systems

The retail giant said the hack cost it £324 million in lost sales, and its profits more than halved in the six months up to September 27 last year.

Another cyber attack on Jaguar Land Rover cost the UK economy £1.9 billion after the car manufacturer halted production at its UK factories for five weeks in September last year.

Meanwhile, Co-op saw payments disrupted and shelves left empty the following month because of the fallout of its cyber-attack.

Hackers also stole Co-op members’ personal data, such as names and contact details.

Around the same time, Harrods restricted internet access across its websites following attempts to gain unauthorised access to its systems.

Prosecutor Mark Fenhalls KC called the TfL hack an ‘unprecedented attack on critical national infrastructure… remarkably sophisticated, on a grand scale’.

He added: ‘The consequences were extremely serious, both in disruption to the public, and remedial work that occupied thousands of hours of work by many, many people, and ultimately cost the public purse £29,000,000.’

He told of a ‘potential consequential loss of £56,000,000,000 to the UK economy had they encrypted or destroyed OneLondon – a central TfL system they gained administrative rights’ to.

The pair carried out the hack between August 31 and September 3, 2024.

At one stage during the attack – in August and September 2024 – Jubair bragged on a hackers’ forum: ‘Scattered Spider is creating webs on the undergrund (sic).’Flowers responded: ‘LOL… this was me.’

Mr Fenhalls said: ‘They searched for and browsed various celebrities and viewed their details stored in the system, but were unable to fully access credit card details.’ Flowers also admitted hacking two US healthcare companies.

During one attack, he messaged an associate that ‘we might be able to extort… but locking is risky might kill some 90yr old on life support’.

Mr Fenhalls said the pair filmed themselves hacking TfL, allowing investigators to see how they worked.

At one stage, they worked together continuously for 16 hours.

Flowers and Jubair admitted conspiracy to commit unauthorised acts in relation to a computer and causing or creating a significant risk of serious damage to human welfare.

They both have histories of cyber-related activity.

At 16, Flowers was visited by a Cyber Choices preventive policing team in October 2023, where he was served with a cease and desist notice over ‘swatting’ – false 911 calls in the US to draw an armed police response.

He declined to take part in a rehab programme.

When arrested in 2024, he had no income but there was $7,100,000, including in crypto, in accounts he controlled.

Jubair previously hacked BT, EE and computer chip giant Nvidia, and has convictions for 22 offences including 13 frauds.

He was subject to a youth rehabilitation order at the time of the TfL offences. He is also wanted in the US, where he faces up to 95 years in jail.

At least $200,000,000 in crypto was moved through his accounts in 2025.

He was also convicted of stalking two young women at a youth court and hacking into a City of London Police server.

Both defendants have been diagnosed with autism, while Jubair also suffers from depression and a severe mood disorder.