A UK court has handed down its heaviest sentence yet against Scattered Spider, showing that the loosely organized, youth-driven crews behind some of the past two years’ most disruptive breaches are not beyond the reach of prosecutors, even when the group itself has no fixed structure to dismantle.
Per the National Crime Agency, Thalha Jubair, 20, and Owen Flowers, 18, were each sentenced to five years and six months in prison after pleading guilty to unauthorized computer access causing serious damage, under Section 3ZA of the Computer Misuse Act, for the September 2024 attack on Transport for London. The NCA said the intrusion cost TfL 29 million pounds in recovery costs and knocked 148 systems offline, disrupting services including Dial-a-Ride bookings, concessionary travel cards, and Oyster refunds. NCA Deputy Director Paul Foster called it the largest cyber crime prosecution ever brought before UK courts, the product of nearly two years of work by the NCA, the Crown Prosecution Service, and policing partners.
The bigger signal for security leaders is the gap between the size of the damage and the size of the crew that caused it. Scattered Spider operates as a loose, shifting collective of mostly young, English-speaking members, which has made it hard to disrupt through the infrastructure and extradition-focused tactics that work against centralized ransomware operations. This sentencing shows prosecuting individual members, even minors and young adults with no fixed base, is viable, but the NCA’s own timeline, arrests in September 2024 and resolution only in mid-2026, shows how resource-intensive that path remains against the speed of the group’s social-engineering tactics. CyberTech has covered how those same tactics, including voice phishing crews abusing Entra passkey enrollment to bypass MFA, keep evolving even as operators face prosecution.
For SOC and legal teams, the case reinforces the value of early, structured law enforcement engagement during a breach, since evidence gathered in the first hours after an intrusion is what eventually supports prosecutions years later.
Source: National Crime Agency
