Teen Cybercriminals Allegedly Continued Attacks from Prison in High-Profile Case Two teenagers linked to the Scattered Spider cybercrime group Thalha Jubair and Owen Flowers are accused of carrying out cyberattacks while in custody, raising serious concerns about prison security measures. The suspects, allegedly involved in high-profile incidents targeting Transport for London (TfL), Marks & Spencer, and Jaguar Land Rover, were initially identified after law enforcement traced cryptocurrency transactions tied to their illicit earnings. Investigators reportedly uncovered the pair’s activities through blockchain analysis, tracking digital payments used for prison commissary purchases. Despite their technical sophistication, operational security lapses such as using traceable crypto for vouchers led to their identification. The case took a troubling turn when authorities alleged the suspects obtained unauthorized devices, including a smartphone and tablet, while incarcerated. These tools may have allowed them to maintain online communications and potentially continue cybercriminal operations, highlighting a critical gap in correctional facility security. Traditional prison controls, designed to restrict physical movement, are ill-equipped to prevent digital threats, where a single internet-connected device can enable attacks, data exchanges, or coordination with criminal networks. Both face charges including SIM swapping, wire fraud, and other cyber-enabled offenses, with potential penalties ranging from lengthy prison sentences to substantial fines. However, the reported persistence of their activities suggests that legal consequences alone may not deter financially motivated cybercriminals, particularly those who amassed millions of pounds through fraud before their arrests. The incident underscores broader challenges in combating cybercrime, extending beyond arrests to secure correctional environments, digital monitoring, and stricter controls on contraband electronics. As cyber threats grow in complexity, the case illustrates that apprehension does not guarantee disruption preventing offenders from operating behind bars is becoming a key priority for law enforcement and cybersecurity strategies.

Cyberattacks Surge in the Automotive Industry: Key Incidents from 2024–2025 The automotive sector has become a prime target for cybercriminals, with attacks ranging from ransomware extortion to large-scale data breaches exposing sensitive customer and operational data. Between 2024 and 2025, major automakers, suppliers, and rental companies faced significant disruptions, underscoring the industry’s vulnerability to digital threats. ### Dark Web Trends: U.S. Dominates as Top Target Dark web activity reveals the U.S. as the most discussed and targeted market, accounting for 23% of automotive-related posts, followed by France (8%) and India (7%). While automobile dealers represent less than 1% of dark web chatter, broader sectors like finance, retail, and technical services many tied to automotive operations remain high-risk targets. ### Major Breaches and Ransomware Attacks - Avis Rent a Car (August 2024): Hackers accessed a business application, exposing 299,006 customers’ personal data, including driver’s licenses, credit card details, and contact information. - Toyota (2024–2025): A third-party breach led to the leak of 240GB of data, including employee records, financial documents, and network credentials. The ZeroSevenGroup claimed responsibility, using ADRecon to map Active Directory environments. Toyota emphasized its systems were not directly compromised. - Kawasaki Motors Europe (September 2024): The RansomHub group stole 487GB of sensitive data after a failed ransomware attack, later dumping the files online when Kawasaki refused to pay. - Volkswagen’s Cariad (November 2024): A cloud misconfiguration exposed terabytes of data, including geolocation records from 800,000 vehicles, some linked to German police and intelligence personnel. Researchers traced the breach to an unsecured AWS memory dump. - Hertz (February 2025): The Clop ransomware gang exploited vulnerabilities in Cleo software, accessing customer data between October–December 2024. Over 3,400 Maine residents were affected, though the full scope remains undisclosed. - Scania (May 2025): Hackers stole insurance claim documents using compromised credentials from an IT partner, later attempting extortion. The data was later offered for sale on the dark web. - Cycle & Carriage (July 2024): A Singapore-based dealer suffered a breach affecting 147,000 customers, with 2% of records containing NRIC numbers and deposit details. - Nissan’s Creative Box Inc. (August 2025): The Qilin ransomware gang stole 4TB of design data, including 3D car models and internal documents, threatening to leak them to competitors. - Jaguar Land Rover (August–September 2025): A cyberattack forced the automaker to halt production at multiple plants, disrupting shipments and dealership operations. While no customer data was compromised, the incident caused widespread operational delays. ### Impact and Industry Response These incidents highlight the automotive sector’s expanding attack surface, from third-party vulnerabilities to cloud misconfigurations and ransomware extortion. Companies have responded with containment measures, forensic investigations, and enhanced security protocols, but the frequency and severity of attacks continue to rise. The financial and operational fallout including production halts, data leaks, and reputational damage underscores the urgent need for stronger cybersecurity defenses across the industry.

In August, Jaguar Land Rover (JLR) suffered a cyber attack that halted its global production lines, causing significant operational disruption. The attack, claimed by a hacker group, forced the company to pause manufacturing activities until earlier this week, leading to financial losses, supply chain delays, and potential reputational damage. While the exact method of compromise was not detailed, the incident aligns with a broader trend of cybercriminals targeting high-profile organizations to maximize disruption. The National Crime Agency (NCA) had previously arrested individuals linked to similar attacks on other major UK retailers, highlighting the coordinated and evolving nature of these threats. The attack underscores the vulnerability of industrial systems to cyber intrusions, where production stoppages can have cascading effects on revenue, customer trust, and market positioning. Though no explicit data breach or ransomware was confirmed, the operational shutdown demonstrates the severe real-world consequences of cyber attacks on critical business functions.