Cyber & Technology — 2026-06-23

Two Scattered Spider Members Plead Guilty on Day One of Trial Over Transport for London Cyberattack

BLUFAt least one defendant will likely receive immediate custody at the July 16 sentencing, with Jubair's parallel US indictment and £29 million in critical infrastructure losses constraining judicial leniency.

Thalha Jubair, 20, of East London, and Owen Flowers, 18, of Walsall, pleaded guilty on June 23 at Woolwich Crown Court, changing their pleas on the first day of a scheduled six-week trial Scattered Spider Hackers Plead Guilty on Day 1 of Trial" data-source="Krebs on Security" data-url="https://krebsonsecurity.com/2026/06/scattered-spider-hackers-plead-guilty-on-day-1-of-trial/" data-otype="blog">123. Both admitted conspiracy to commit unauthorized acts against TfL computer systems and causing risk of serious damage to human welfare 13. The NCA reported the August-September 2024 intrusion forced all 28,000 TfL employees to reset passwords in person, caused approximately £29 million in losses, and exposed data from the Oyster refund system 23. Investigators seized a laptop from Flowers containing a screenshot showing connectivity to TfL infrastructure and recovered videos showing Jubair accessing TfL systems during the attack; sentencing is set for July 16 23.

Analysis
The Day 1 plea, with a six-week trial on the docket, signals a forensically uncontestable position. NCA forensics, the primary record broadly amplified but not independently cross-checked, include video of Jubair accessing TfL systems and a Flowers laptop screenshot documenting live connectivity. At least one defendant will likely receive immediate custody at the July 16 Woolwich sentencing given a maximum-life-term charge and £29 million in CNI losses. Moderate confidence reflects the guilty-plea discount and defendants' youth, mitigating factors not yet weighed. The plea may equally reflect counsel's read that jury sympathy for CNI attacks is negligible rather than evidence genuinely beyond contest. Jubair's parallel New Jersey indictment, 120 intrusions and $115 million in ransoms, constrains the low end of the UK range and leaves US prosecutors calibrating extradition timing on the July 16 outcome.
5 sources
  1. Scattered Spider Hackers Plead Guilty on Day 1 of Trial - Krebs on Security
  2. Scattered Spider members plead guilty to hacking Transport for London - BleepingComputer
  3. Two Scattered Spider members plead guilty over cyberattack that crippled London transit - The Record
  4. Two men, believed to part of Scattered Spiders, plead guilty over £39m TfL cyber attack - DataBreaches.Net
  5. Cyber criminals who hacked into Transport for London's computer network are convicted - National Crime Agency

View in full brief →

UNCLASSIFIED // OPEN SOURCE