Scattered Spider teens jailed 5.5 years for £29M TfL attack – extradition looms

For cybersecurity professionals, the sentencing of Thalha Jubair and Owen Flowers provides a stark case study in the new breed of threat actors: socially isolated teenagers leveraging advanced social engineering to breach critical infrastructure. The Scattered Spider group’s ability to extract £29M in a single attack on TfL, while simultaneously extorting over £87M from US companies, underscores the evolving ransomware and extortion ecosystem that blends technical prowess with crypto obfuscation.

In a landmark sentencing at Woolwich Crown Court, two British teenagers were each jailed for five years and six months for masterminding a devastating cyber attack on Transport for London that cost an estimated £29 million and threatened up to £56 billion in "catastrophic damage." Thalha Jubair, 20, and Owen Flowers, 18, operated as core members of the notorious Scattered Spider hacking group, a collective responsible for a spate of high-profile breaches against global corporations. Their conviction and the detailed revelations about their crypto-fuelled criminal lifestyle provide a chilling case study in the evolving threat landscape, blending sophisticated social engineering, massive ransomware extortion, and the tracing of digital currency to bring perpetrators to justice.

“

Cryptocurrency was the lifeblood of their operations: court records revealed that $200 million in digital assets had passed through accounts linked to Jubair, while Flowers controlled wallets holding $7.1 million.

The attack on TfL was a four-day onslaught that could have "shut down TfL completely," according to court testimony. The transport authority’s security teams narrowly averted total paralysis by disconnecting the network before the hackers could inflict irreversible harm. The potential £56 billion loss underscores the fragility of critical national infrastructure when pitted against determined, albeit young, threat actors. The pair’s motivation, as Judge Mark Turner noted, was "selfish bravado, heedless of the severe consequences to others," a mindset alarmingly common among a generation of cybercriminals who see hacking as a route to notoriety and easy wealth.

Jubair’s involvement extended far beyond the TfL incident. US prosecutors have charged him in New Jersey with extorting at least £87 million from 47 American companies between 2022 and 2025, marking him as a serial cyber extortionist. The Scattered Spider network, to which both belonged, is linked to attacks on Jaguar Land Rover (costing £1.9 billion), Marks & Spencer (£300 million), Harrods, and the Co-op (with £206 million in losses). These staggering figures illustrate the group’s ability to target sectors ranging from luxury retail to automotive and food supply, often using a blend of phishing, social engineering, and ransomware deployment. Cryptocurrency was the lifeblood of their operations: court records revealed that $200 million in digital assets had passed through accounts linked to Jubair, while Flowers controlled wallets holding $7.1 million.

Ironically, it was the mundane spending of those crypto gains that led to Jubair’s downfall. The FBI traced a £27 million haul from a ransom payment to a cryptocurrency wallet that Jubair then used to purchase food delivery vouchers. By following the digital breadcrumbs from the takeaway orders to his home address—a flat in a 22-storey tower where he lived with his parents—agents unmasked the then-17-year-old autistic loner. This breakthrough highlights the increasing effectiveness of blockchain analysis in piercing the anonymity once thought impenetrable. Despite misdirection attempts, such as moving $10 million from wallets after Jubair’s release from custody in March 2025, law enforcement’s ability to track the flow of illicit funds proved decisive.