British police said Thursday that the jailing of two teenage hackers has “seriously” disrupted the activities of the notorious cybercrime group known as Scattered Spider.
Owen Flowers, 18, and Taha Jubail, 20, pleaded guilty earlier this year to hacking Transport for London (TfL), the government agency that oversees the British capital's public transport system, in 2024. On Thursday, the two were sentenced to five years and six months in prison.
The incarceration of Mr. Flowers and Mr. Jubea is a reminder that the most dangerous and talented hackers do not work for sophisticated government agencies with multi-million dollar budgets. They are often very young and clever hackers motivated by money and notoriety among their peers.
Groups such as Scattered Spider and another cybercrime group, ShinyHunters, often target employees and individuals rather than computer systems, a strategy that is both effective and difficult to counter.
Although members of hacking groups tend to come and go, it is possible for the groups themselves to rebrand. But British authorities believe Flowers and Joubert's imprisonment will be a significant blow to the amorphous group Scattered Spiders, which has been linked to dozens of high-profile attacks, including those against casino giant MGM, airline WestJet and cybersecurity firm Okta. These attacks gave hackers access to some of these companies' customers.
Paul Foster, head of the National Crime Agency's National Cyber Crime Unit, said: “Scattered Spiders have become the most significant cybercrime threat to the UK in recent years. Through this investigation, we have successfully stopped this threat and brought the key perpetrators to justice.”
Two young people have been found guilty of launching a cyberattack on Transport for London (TfL), causing tens of millions of pounds in damage and inconveniencing thousands of customers.
Talha Jubail and Owen Flowers were identified by the NCA and @CityPolice after the attack… pic.twitter.com/ZJdmdZhXRJ
— National Crime Agency (NCA) (@NCA_UK) July 16, 2026
The two hackers launched a cyberattack against TfL in the summer of 2024, taking system infrastructure offline, including the ticketing system and online real-time train arrival information system. The chaos continued for several weeks.
Flower and Jubail were arrested a year later. At the time, the FBI accused Joubea of being involved in attacks on more than 120 companies using social engineering tactics.
Authorities said the attack on TfL resulted in losses of around £29 million (about $47 million). The Guardian said the two hackers had such deep access to TfL's systems that they “could have shut down TfL completely and shut it down” and held the “keys to the kingdom” of the company's systems.
If you buy through links in our articles, we may earn a small commission. This does not affect editorial independence.