Owen Flowers and Thalha Jubair pleaded guilty to unauthorised computer access under section 3ZA of the Computer Misuse Act over the intrusion into Transport for London, and on 16 July 2026 each was sentenced to five years and six months’ imprisonment. The National Crime Agency has described it as the United Kingdom’s biggest cyber crime case of its kind.
The agency described both as leading members of the Scattered Spider collective. Flowers was 18 and Jubair 20. Contemporaneous reporting described a further arrest of a 17-year-old; the agency’s sentencing announcement does not mention one, and no minor is named here in any event.
Why The Names Appear Here And Nowhere Else
This desk names individuals after conviction, not after arrest. The rule was set at 25-0724, restated at 25-1205, applied to a ransomware leader identified only by researchers at 25-0222, and applied again to the Snowflake arrests at 24-1030 where the names were widely published elsewhere and are still not in this corpus.
A rule that only ever withholds is not a rule about evidence; it is a policy of silence. The test of this one is that it produces a name when the threshold is met, and here it is met: guilty pleas, entered in court, followed by sentence.
The Ages Are The Part The Corpus Keeps Refusing To Be Reassured By
Three of the largest incidents in this database were carried out by people under 21. The comfortable reading is that the adversary is unsophisticated and therefore beatable.
The corpus refused that at 25-0724 and refuses it again. A technique that a teenager can execute against a city’s transport authority is worse than one requiring a state programme, because the population capable of running it is enormous.
One Detail From The Sentencing Is Worth Separating Out
The agency states that when Flowers was arrested on 6 September 2024, he was actively inside the systems of two American healthcare organisations, SSM Health Care Corporation and Sutter Health.
Arrested mid-intrusion, in another country’s hospital systems. This corpus files healthcare availability harm throughout 2024 — at 24-0508, at 24-0603, at 24-0604 — and that is the population this activity was reaching while an arrest was being executed.
Prosecution Is Rare And This Is Why The File Matters
Most incidents in this corpus end without anybody being identified, let alone charged. Attribution is usually an assessment; a court finding is the only category the desk treats as established, and almost nothing reaches it.
That scarcity is the reason the standard costs so little to hold. Waiting for conviction means printing very few names, and the alternative is printing many that no court will ever test.
Based on the National Crime Agency’s sentencing announcement, which this desk read directly, together with its earlier conviction announcement and contemporaneous reporting; all are listed below. Graded high: the guilty pleas, the offence, the sentences and the sentencing date come from the investigating agency. The individuals are named because the corpus standard set at 25-0724 — name after conviction, not after arrest — is satisfied; this is the first file in which it has been. Any further arrested individual who was a minor is not named. This file is dated to the incident period; sentencing followed on 16 July 2026. Corrections: corrections@forensicpost.com.