Owen Flowers, 18, from Walsall, and Thalha Jubair, 20, from east London, have each been sentenced to five years and six months in prison for a 2024 cyber-attack on Transport for London that they carried out as teenagers while livestreaming the 16-hour hack. Woolwich Crown Court heard the pair, both described as computer-obsessed loners with autism diagnoses and few offline friends, pleaded guilty in June to an attack linked to the Scattered Spider hacking collective, which the National Crime Agency says exemplifies the growing threat posed by young cyber criminals in the UK and has also been tied to attacks on Marks & Spencer and the Co-op.

The attackers tricked a phone help desk worker into resetting a TfL employee's password, gaining access to a database of Oyster card customers, searching it for celebrities' details and attempting to reach banking information; TfL says the breach exposed data on as many as 10 million customers, which is still circulating in criminal groups, and forced all 27,000 staff to reset passwords in person. The hack knocked out 148 technology systems, disrupting services including the Dial-a-ride scheme for disabled and vulnerable Londoners, and cost TfL an estimated £29m plus £10m in lost income. The judge cited the men's youth and autism diagnoses as mitigating factors in sentencing.