Scattered Spider Hackers Sentenced in Landmark U.K. Cybercrime Case Two key members of the Scattered Spider cybercrime group have been sentenced to over five years in prison for their roles in the 2024 cyberattack on Transport for London (TfL), marking the largest prosecution under the U.K.’s Computer Misuse Act to date. Thalha Jubair, 20, of East London, and Owen Flowers, 18, from Walsall, were each sentenced to five years and six months at Woolwich Crown Court on Thursday after pleading guilty to charges under Section 3ZA of the Computer Misuse Act. The pair admitted to infiltrating TfL’s network, causing widespread disruption, exposing customer data, and incurring £29 million ($39 million) in recovery costs. The attack, which TfL managed to contain before it could cripple London’s transport network, forced 27,000 employees to reset passwords in person and rendered 148 internal systems unavailable. Critical operations were disrupted, including the Oyster card refund system, leading to delays for passengers and a temporary suspension of applications for youth travel cards. Authorities warned that the financial impact could have been far worse had the attackers succeeded in disabling the transport network, the estimated economic damage could have reached £56 billion ($75.6 billion). Jubair and Flowers were identified as leading figures in Scattered Spider, a transatlantic cybercriminal collective linked to high-profile attacks on airlines, retailers, insurers, and tech firms. The group is known for using social engineering, SIM-swapping, and credential theft to gain access before deploying ransomware or extortion campaigns. The National Crime Agency (NCA) stated that arrests in September 2024 significantly disrupted Scattered Spider’s operations, with Microsoft confirming the group’s capabilities had been "materially degraded." Investigators found evidence of the attack on Flowers’ devices, including a screenshot of TfL’s infrastructure and videos allegedly showing Jubair accessing systems. The pair coordinated the intrusion via Telegram and an online workspace. Flowers was initially arrested in September 2024 while simultaneously targeting U.S. healthcare providers SSM Health Care Corporation and Sutter Health. Both defendants faced additional legal complications Flowers for breaching bail conditions and Jubair for refusing to disclose passwords for seized devices. The case has prompted calls for new legal measures, including proposed Cyber Crime Risk Orders, which would restrict convicted offenders’ access to technology post-release to prevent reoffending. Security officials emphasized the importance of early victim reporting, crediting TfL’s swift engagement with law enforcement for enabling the convictions. The investigation was led by the NCA and City of London Police, with support from domestic and international agencies, including the FBI. Jubair and Flowers were also linked to suspected ransomware attacks on British retailers Marks & Spencer, the Co-op, and Harrods, though no charges have been filed in those cases.