Two key figures behind the notorious Scattered Spider hacking collective have been sentenced to 66 months in prison in the United Kingdom, marking a significant blow to the group’s operations. Thalha Jubair and Owen Flowers, both in their late teens, were arrested in September 2025 for their role in a high-profile cyberattack on Transport for London (TfL) that brought the network to its knees in 2024.
The duo was at the helm of Scattered Spider, a subgroup of The Com, a larger hacking collective. According to researchers, Jubair and Flowers were deeply involved in the group’s activities, with Jubair being a prolific cybercriminal who had been accused by U.S. authorities of participating in over 120 cyberattacks, including the January 2025 attack on the federal court system. These attacks resulted in significant financial losses for organizations, with at least $89.5 million in cryptocurrency being funneled to Bitcoin addresses and servers controlled by Jubair.
The TfL attack, which was carried out using a combination of social engineering techniques and data extortion, caused widespread disruption to the network’s operations. The arrest of Jubair and Flowers has been hailed as a major success for law enforcement agencies, with officials claiming that it effectively halted Scattered Spider’s criminal activity. However, despite this assertion, other cybercriminals have continued to use the group’s brand in recent attacks.
The sentencing of Jubair and Flowers is seen as a significant step towards holding accountable those responsible for Scattered Spider’s malicious activities. The group has been known to employ various tactics, including SIM-swap attacks and data extortion, to infiltrate networks and compromise critical services. Assistant Director Brett Leatherman of the FBI Cyber Division noted that the sentencing “represents a significant step in holding accountable two members of Scattered Spider.”
However, some experts have expressed concerns about the leniency of the sentence. Allison Nixon, chief research officer at Unit 221B, pointed out that the punishment is remarkably short considering the period of continuous reoffending by Jubair and Flowers. She hopes that the United States will eventually extradite the pair to face additional charges, which would prevent them from using mental illness as a loophole to escape further consequences.
This case highlights the ongoing threat posed by cybercrime groups like Scattered Spider, which continue to victimize organizations around the world with significant financial and operational harm. As law enforcement agencies work tirelessly to disrupt these groups’ activities, it’s essential for individuals and organizations to remain vigilant and take proactive steps to protect themselves against cyber threats.
In light of this case, cybersecurity experts stress that it’s crucial for organizations to implement robust security measures, including regular software updates, employee education, and incident response planning. Individuals can also take simple steps to secure their online presence, such as using strong passwords, enabling two-factor authentication, and being cautious when clicking on links or providing sensitive information over the internet.
Ultimately, the sentencing of Jubair and Flowers serves as a reminder that cybercrime is a serious threat that demands attention from both law enforcement agencies and individuals. By staying informed and taking proactive measures to protect themselves online, people can help prevent the devastating consequences of cyberattacks like the one carried out by Scattered Spider.
Source: CyberScoop — 2026-07-17