Two Teenage Hackers Jailed in UK, Police Say the Sentencing Cripples Scattered Spider

British police say the jailing of two young hackers has landed a serious blow against Scattered Spider, the loosely organized cybercrime group blamed for some of the most damaging corporate hacks of the past few years.

Owen Flowers, 18, and Thalha Jubair, 20, were sentenced on Thursday to five years and six months in prison after pleading guilty earlier this year to hacking Transport for London, the agency that runs the British capital's subways and buses. The attack, carried out in the summer of 2024, knocked out core pieces of TfL's infrastructure, including its ticketing system and the real-time train arrival feeds commuters rely on. The disruption dragged on for weeks. Authorities estimate the incident cost roughly £29 million, or about $47 million.

According to reporting from the Guardian, the two hackers didn't just poke a hole in TfL's defenses, they burrowed all the way in. Investigators say Flowers and Jubair had access deep enough that they "could have shut out and shut down TfL completely," effectively holding "the keys to the kingdom" when it came to the transit authority's systems.

Flowers and Jubair were arrested a year after the attack. At the time, the FBI separately accused Jubair of participating in intrusions at more than 120 companies, relying heavily on social engineering, the practice of manipulating people rather than breaking software, to get in the door.

A young, decentralized, and effective threat

Paul Foster, who leads the U.K. National Crime Agency's National Cyber Crime Unit, was blunt about what this case means for the broader fight against Scattered Spider. "Scattered Spider has been the most significant cybercrime threat to the U.K. in recent years. Through this investigation, we have severely disrupted that threat and brought key offenders to justice," Foster said.

That's a notable claim, because Scattered Spider isn't a traditional hacking outfit with a fixed roster and a hierarchy. It's better described as a loose, shifting network of hackers, many of them young, who've been tied to a string of major breaches, including attacks on casino operator MGM, airline WestJet, and identity management company Okta. Those intrusions gave attackers a foothold into the data of each company's customers, rippling well beyond the initial targets.

The case underscores something security researchers have been saying for a while: the hackers causing the most damage right now aren't necessarily state-sponsored operations with deep pockets and years of tradecraft behind them. Often, they're teenagers and young adults who are good at manipulating people, motivated by money, status among their peers, or both. Scattered Spider and a similar group known as ShinyHunters have both built their reputations on targeting employees directly, tricking help desks or individuals into handing over credentials, rather than grinding through firewalls or exploiting obscure software bugs. That approach is cheap, scalable, and notoriously hard for companies to defend against, because it exploits human trust instead of a technical flaw that can simply be patched.

Why this arrest may not be the end of the story

Groups like this tend to survive their own members. People cycle in and out, and the collective identity can persist, or rebrand entirely, even after key figures are arrested. That history is exactly why British authorities are framing this case as more than a routine prosecution. They're presenting it as a genuine disruption of Scattered Spider's operating capacity, not just the removal of two participants from a much larger pool.

Whether that holds up will depend on what happens next: whether attacks tied to the group's tactics slow down, whether new members step into the roles Flowers and Jubair played, or whether the group's infrastructure and techniques simply get picked up under a different name. For now, U.K. police are treating this as one of the more consequential wins yet in the effort to chase down the individuals behind Scattered Spider's spree of high-profile breaches, a case that also serves as a stark reminder of how much damage a couple of young hackers with the right social engineering skills can inflict on a major public institution.