Thalha Jubair and Owen Flowers were each sentenced to five years and six months at Woolwich Crown Court on 16 July 2026, having pleaded guilty to offences under section 3ZA of the Computer Misuse Act. Both were linked to the group tracked as Scattered Spider.
The offences concern unauthorised access to Transport for London’s systems between 31 August and 3 September 2024 — the incident this desk filed at 24-0901. British authorities described it as the largest cybercrime prosecution brought before a UK court.
The Court Record Is Worse Than The Contemporaneous One
The 2024 file recorded around 5,000 customers written to over bank account numbers and sort codes drawn from the Oyster refund system, and a recovery cost of about £29 million. That was what was public.
Reporting of the proceedings adds that 148 systems were taken offline, some requiring manual workarounds for weeks, and that all 27,000 employees had to attend in person to reset passwords. The confidentiality count stayed small. The operational damage was much larger than the disclosure regime ever asked anyone to state.
Twenty-Seven Thousand People In A Queue
An in-person password reset for an entire workforce is the physical form of a broken identity system. It happens when an organisation can no longer trust any remote channel to prove who is on the other end, so it falls back to the only method left: look at the person.
The corpus records the same collapse at 23-0913, where a synced authenticator turned a second factor into no factor, and at 25-0421b, where adversaries simply logged in with valid credentials. Once identity fails, the remedy is not technical.
Naming, And Why This File Does It
This database names individuals only after conviction. Both men pleaded guilty and have been sentenced, so they are named here; the corpus declined to name anyone at 26-0725, where four people had been arrested and nothing had been proved.
The desk notes their ages as reported — 20 and 18 — without drawing a conclusion from them. It also records that some reporting puts the TfL cost at £39 million rather than £29 million. This file keeps £29 million, consistent with 24-0901 and with the majority of reporting, and flags the discrepancy rather than silently picking the larger number.
Built on contemporaneous reporting of the 16 July 2026 sentencing at Woolwich Crown Court. The sentence length, the guilty pleas, the section 3ZA charges, the names and reported ages, the 148 systems figure and the 27,000-employee password reset are as reported from the proceedings; this desk has not read a court transcript or judgment. The £29 million recovery cost and the roughly 5,000 customers notified come from the earlier record at 24-0901. Some outlets report the cost as £39 million; the discrepancy is noted in the body and the lower, more widely reported figure is carried. The individuals are named because they have been convicted and sentenced, per the standard set out at 26-0725. Graded high. Corrections: corrections@forensicpost.com.