Carmen EstelaCyber Defense Magazine
July 17, 2026
Scattered Spider Hackers Sentenced over Mass-Affecting Transit Attack
Two well-known members of the notorious hacking group Scattered Spider were sentenced to prison in the UK on July 16, 2026. Owen Flowers, 18, and Thalha Jubair, 20, both admitted their roles in the devastating September 2024 hack on Transport for London, or TfL, and were sentenced to five and a half years at Woolwich Crown Court. The incident caused 148 internal systems to go offline, necessitating the manual password resets of thousands of employees. The outcome was an incredible 29 million pounds spent on cleanup and rehabilitation.
Real-World Impacts on Commuters and US Healthcare Systems
The fallout of this attack directly impacted millions of everyday commuters and vulnerable residents. The hackers managed to compromise TfL’s refund systems and shut down the application portal for Oyster photocards, which prevented children and young people from accessing discounted travel cards. It also severely disrupted the Dial-a-Ride booking system, a critical transport service used by elderly and disabled Londoners. Beyond transit riders, the criminal activities of this group extended to the healthcare sector, as Flowers also targeted two major non-profit healthcare providers in the United States, SSM Health Care Corporation and Sutter Health, putting sensitive patient systems and operations at serious risk.
Author Notes
National Crime Agency, “Two sentenced for hacking Transport for London in UK’s biggest ever cyber crime case” (July 16, 2026).
About the Author
Carmen Estela is a Cybersecurity Research Analyst at Cyber Defense Magazine and a Women in Cybersecurity Award Candidate. She recently graduated with a Master’s of Science degree from the University of Central Florida and holds a Bachelor’s degree in Criminology from the University of Florida with certifications in Data Analytics and AI Fundamentals. She frequently speaks and volunteers at well-known industry gatherings, such as BSides Orlando and BSides Jax, where she offers her perspectives on emerging cyber trends. Carmen is committed to advancing the standards of governance, risk, and compliance within cybersecurity. She has also served as an adult protective investigator, police dispatcher, and legal intern, applying investigative skills across law enforcement, academic, and public service settings.
Reach her online at [email protected].
