Scattered Spider Hackers Receive Sentences for Disruptive Transit Attack
In a significant development, two members associated with the renowned hacker group Scattered Spider have been handed prison sentences in the UK on July 16, 2026. Owen Flowers, aged 18, and Thalha Jubair, aged 20, have both confessed to their involvement in the impactful hack on Transport for London (TfL) in September 2024. The duo has been sentenced to five and a half years at Woolwich Crown Court. This cyber breach led to the disabling of 148 internal systems, prompting the manual resetting of passwords for thousands of employees. The aftermath of the incident resulted in a staggering expenditure of 29 million pounds for cleanup and recovery efforts.
Direct Consequences on Commuters and Healthcare Systems
The repercussions of this attack directly affected a vast number of daily commuters and vulnerable individuals. The hackers successfully infiltrated TfL’s refund mechanisms and disrupted the application portal for Oyster photocards, hindering children and young individuals from accessing discounted travel cards. Additionally, they severely disrupted the Dial-a-Ride booking system, a vital transport service utilized by elderly and disabled residents of London. Apart from the transit users, the criminal actions of this group extended to the healthcare sector, as Flowers targeted two major non-profit healthcare providers in the United States, namely SSM Health Care Corporation and Sutter Health, endangering sensitive patient systems and operations.
Insights from the Author
The National Crime Agency reported on the sentencing of the two individuals involved in the TfL hacking incident, marking it as the UK’s most significant cybercrime case to date (July 16, 2026).
Carmen Estela, a Cybersecurity Research Analyst at Cyber Defense Magazine and a candidate for the Women in Cybersecurity Award, shares her expertise. She recently completed her Master’s of Science degree at the University of Central Florida and holds a Bachelor’s degree in Criminology from the University of Florida, with certifications in Data Analytics and AI Fundamentals. Carmen actively participates in prominent industry events like BSides Orlando and BSides Jax, offering insights on emerging cybersecurity trends. She is dedicated to enhancing the standards of governance, risk, and compliance within the cybersecurity realm. With prior roles as an adult protective investigator, police dispatcher, and legal intern, Carmen has applied her investigative skills across various sectors, including law enforcement, academia, and public service.
Contact Carmen via email at [email protected].
