UK police have said the jailing of two young hackers has severely disrupted the operations of Scattered Spider, a notorious cybercrime group linked to major attacks worldwide. Owen Flowers, 18, and Thalha Jubair, 20, were sentenced on Thursday to five years and six months in prison after pleading guilty to hacking Transport for London (TfL) in 2024, an attack that highlights how young, financially and reputationally motivated individuals rather than state-backed operatives can pose some of the most serious cybersecurity threats.

The attack on TfL knocked out core infrastructure, including the ticketing system and real-time train arrival information, for several weeks and caused losses of around £29 million. Investigators said the pair had such deep access that they could have shut TfL's systems down entirely, and Jubair was separately linked by the FBI to attacks on more than 120 companies. Scattered Spider has also been tied to breaches at MGM Resorts, WestJet and Okta; the National Crime Agency's Paul Foster called the group the most significant cybercrime threat to the UK in recent years and said the investigation had dealt it a severe blow, though experts caution such groups can rebrand even as individual members are jailed.