The duo behind the major 2024 cyberattack are reported to have been leading members of the Scattered Spider cybercrime collective.

Two men responsible for the 2024 cyberattack on Transport for London (TFL) have each been sentenced to five and a half years in prison by a UK court.

Owen Flowers and Thalha Jubair, who were teenagers at the time of the cyberattack, were sentenced today (16 July) at Woolwich Crown Court after previously pleading guilty to the hack. The pair were arrested and charged last year.

In late August and early September in 2024, Flowers and Jubair gained access to TFL customer data after impersonating an employee and tricking a phone helpdesk worker into resetting that employee’s password – leading to the theft of around 10m customers’ data.

The cyberattack – which cost TFL £29m – disrupted a number of transportation services in the UK’s capital, including a booking service that provides transport to vulnerable Londoners, while 148 technology systems were rendered inoperable.