Two young men linked to the Scattered Spider hacking group have been sentenced to five years and six months in prison for the 2024 cyber-attack on Transport for London.

Key Points

• Owen Flowers and Thalha Jubair pleaded guilty to unauthorized system access under the UK’s Computer Misuse Act.
• The 2024 attack cost Transport for London approximately £39 million in recovery expenses and lost revenue.
• The breach compromised data for up to 10 million people, forcing the suspension of Oyster photocard and Dial-a-Ride services.
• Perpetrators used social engineering and SIM swapping to bypass two-factor authentication and escalate privileges within internal systems.
• The National Crime Agency identified this as the largest cybercrime prosecution in UK history, significantly disrupting the Scattered Spider collective.

Why it Matters

This case highlights the severe operational and financial risks posed by organized cybercriminal groups targeting critical national infrastructure. It serves as a landmark legal precedent for the UK, demonstrating the government's commitment to prosecuting high-level digital threats despite the perpetrators' youth.