UK Police Say Arrest of Two Hackers Severely Disrupted Scattered Spider

British authorities say the imprisonment of two young hackers has dealt a significant blow to the cybercrime group known as Scattered Spider, one of the most active hacking collectives targeting major organisations in recent years. The UK National Crime Agency (NCA) said the convictions have “severely” disrupted the group’s operations after two members admitted carrying out a high-profile cyberattack against Transport for London (TfL).

Owen Flowers, 18, and Thalha Jubair, 20, pleaded guilty earlier this year to their roles in the 2024 attack on TfL, the public body responsible for London’s transport network. On Thursday, both were sentenced to five years and six months in prison for their involvement in the incident, which caused widespread disruption to the capital’s transport infrastructure.

The attack forced several TfL systems offline, including ticketing services and real-time train arrival information, with disruptions lasting for weeks. Authorities said the cyberattack resulted in financial losses of approximately £29 million (around $47 million). According to court proceedings cited by The Guardian, the hackers gained such extensive access to TfL’s systems that they effectively held “the keys to the kingdom” and could have shut down the organisation’s operations entirely.

The case highlights a growing trend in cybercrime, where highly capable young hackers, rather than state-sponsored groups, are responsible for some of the world’s most damaging attacks. Groups such as Scattered Spider and ShinyHunters frequently rely on social engineering techniques, targeting employees and individuals rather than exploiting software vulnerabilities. By manipulating people into revealing credentials or granting access, these groups have successfully breached numerous high-profile organisations.

Although cybercriminal groups often evolve as members leave or rebrand under new identities, UK investigators believe the convictions represent a major setback for Scattered Spider. The group has been linked to attacks against casino operator MGM Resorts, airline WestJet and cybersecurity company Okta, incidents that also exposed customer information and disrupted business operations.

Paul Foster, head of the National Cyber Crime Unit at the NCA, described Scattered Spider as the most significant cybercrime threat facing the United Kingdom in recent years. He said the investigation had significantly disrupted thegroup’ss activities while bringing key offenders to justice.

Flowers and Jubair were arrested in 2025 following an extensive investigation into the TfL breach. Around the same time, the FBI alleged that Jubair had also been involved in social engineering attacks affecting more than 120 companies, highlighting the international reach of the group’s operations.

The convictions demonstrate the increasing focus of law enforcement agencies on dismantling organised cybercrime networks by identifying and prosecuting individual members. While authorities acknowledge that groups like Scattered Spider may continue to evolve, they believe that removing experienced operators can significantly weaken their ability to carry out future attacks against businesses and public organisations.