Two young men have been sentenced to five years and six months in prison each for the cyber-attack against Transport for London (TfL) after the judge found their actions were motivated in part by “selfish bravado” rather than purely financial gain. Owen Flowers, 18, and Thalha Jubair, 20, were charged with committing unauthorised acts against TfL under the UK’s Computer Misuse Act (CMA). On June 22, 2026, they pleaded guilty to carrying out the attack in what was only the second criminal prosecution of its kind in the UK under the CMA. The sentence was pronounced by Judge Justice Turner at Woolwich Crown Court, London, on July 16. It considers the guilty pleas for both defendants, as well as mitigating factors - such as their youth and diagnosed neurodiversity – and aggravating factors, notably the fact their “high expertise" meant they likely understood the impact of their actions. Flowers and Jubair are believed to be part of a group known as Scattered Spider . The group has been linked to major cyber-attacks over the past few years, including the Marks & Spencer and Co-op incidents in 2025. Alongside other groups like Lapsus$ and ShinyHunters , Scattered Spider emanated from a loose collective known as The Com. TfL Cyber-Attack Caused Significant Financial and Operational Impact According to the UK’s National Crime Agency (NCA), the cyber-attack cost TfL £29m ($38m) in loss and recovery costs, with TfL claiming an additional £10m ($13.5m) in lost income. While the incident did not directly impact the TfL transport system, it had a ripple effect on many of the company’s internal and customer-facing systems. For instance, the perpetrators gained access to data from TfL’s Oyster refund system, leading to the company to close down applications for Oyster photocards for children and young people. Additionally, the booking system for the Dial-a-Ride buses used by people with disabilities was shut down because of the breach and data on live tube times for apps such as TfL Go and CityMapper was taken offline. More than 27,000 TfL employees were also required to reset their passwords in person. In total, the hack is estimated to have affected between seven and 10 million people across the UK. Had the attack succeeded in shutting down the transport network the estimated cost to the UK economy could have been up to £56bn ($75bn), according to the NCA. Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said, “This is the largest cybercrime prosecution ever brought before the UK courts and the culmination of nearly two years of painstaking work by the NCA, Crown Prosecution Service (CPS) and our policing partners.” “Scattered Spider has been the most significant cybercrime threat to the UK in recent years. Through this investigation, we have severely disrupted that threat and brought key offenders to justice,” he added. Image credit: Mounir Taha / Shutterstock.com