IC Technology & Cyber — 2026-07-18

Scattered Spider Leaders Sentenced to 66 Months in UK as FBI Calls Group Ongoing Global Threat

BLUFScattered Spider will likely be publicly linked to a new major intrusion within 90 days of sentencing, as the custodial removal of two operators leaves the group's decentralized tradecraft and unindicted affiliates intact.

Woolwich Crown Court sentenced Thalha Jubair, 20, and Owen Flowers, 18, to five years and six months in prison each on Thursday for the 2024 cyberattack on Transport for London, the National Crime Agency reported, calling it the largest cybercrime prosecution ever brought before a UK court 12. Both pleaded guilty last month to offenses under Section 3ZA of the Computer Misuse Act after infiltrating TfL's network between August 31 and September 3, 2024, an intrusion the NCA said cost £29 million in recovery costs, forced password resets for all 27,000 TfL employees, and disabled 148 internal systems 123. The NCA and Microsoft assessed that the arrests materially degraded the group's operational capability, while the FBI's Brett Leatherman said Scattered Spider members continue to victimize organizations globally using data extortion, SIM-swapping, and social engineering 14. US authorities have separately accused Jubair of involvement in at least 120 cyberattacks, including extortion of 47 US-based organizations and the January 2025 breach of the federal court system, with a criminal complaint tracing $89.5 million in cryptocurrency payments to Bitcoin addresses he controlled 4.

Analysis
The sentencing removes two of Scattered Spider's four principal operators, but the group's brand and tradecraft persist among unindicted affiliates who continue targeting new victims, and members will likely surface in connection with a new major intrusion within 90 days given the FBI's own ongoing-threat assessment and sustained tempo through prior arrests. Moderate confidence reflects the claim's broad construction, tempered by law enforcement pressure that could push survivors toward less attributable methods. The NCA-Microsoft degradation assessment rests on a single institutional statement, with independent researchers disputing it since the pair's offending outlasted their eventual custodial term, and reflects the removal of two individuals rather than dismantlement of the wider criminal ecosystem. Jubair's separate US indictment, covering 120 intrusions and the January 2025 federal court breach, keeps extradition and further prosecution live, and a fresh affiliate-linked intrusion within that window would pressure agencies to shift from prosecution-as-deterrence toward direct disruption of the group's infrastructure.

4 sources

Two sentenced for hacking Transport for London in UK's biggest ever cyber crime case - National Crime Agency
Scattered Spider hackers sentenced to 5.5 years over £29 million Transport for London hack - The Record (Recorded Future News)
Brit Scattered Spider duo handed tickets to prison over Transport for London attack - The Register
Leading members of Scattered Spider sentenced in UK to 66 months in jail - CyberScoop