Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack

Summary: Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court on 16 July 2026 for the 2024 hack of Transport for London, which left 148 TfL systems inoperable and forced all 27,000 employees to reset passwords in person. Both pleaded guilty on 22 June 2026 to Section 3ZA of the Computer Misuse Act 1990, the Act's most serious charge, and the NCA and CPS put TfL's losses and recovery costs at £29 million.
Bottom line: The NCA says a successful shutdown of TfL's network could have cost the UK economy up to £56 billion, and it stayed hypothetical only because TfL pulled its own network down to contain the intruders. Flowers was arrested at home on 6 September 2024 while, per the NCA, he was mid-attack on two US healthcare organisations, and the CPS says he acknowledged in chats that locking those systems down 'might kill some 90-year-old on life support.'

Read the original at The Hacker News ↗