UK cops say arrest of two young hackers disrupted the operations of an infamous hacking group

British law enforcement announced on Thursday that the imprisonment of two young hackers has significantly disrupted the operations of the notorious cybercrime organization known as Scattered Spider. Owen Flowers, aged 18, and 20-year-old Thalha Jubair both pleaded guilty earlier this year for their involvement in a high-profile hacking incident targeting Transport for London (TfL), the agency responsible for the capital's public transportation system. On Thursday, they were sentenced to five years and six months in prison. Their case underscores a critical point: some of the most effective hackers are not necessarily associated with well-funded government agencies, but rather are often young individuals driven by the allure of financial gain and notoriety among their peers. Groups like Scattered Spider and ShinyHunters frequently focus on exploiting individuals rather than merely targeting computer systems, a tactic that proves both efficient and difficult to combat. Although members of hacking collectives may change over time, the organizations themselves can easily rebrand. Nonetheless, British authorities believe that the sentencing of Flowers and Jubair represents a significant setback for Scattered Spider, which has been implicated in numerous high-profile breaches, including attacks on MGM Resorts, WestJet airlines, and cybersecurity firm Okta, compromising sensitive customer data. Paul Foster, the head of the U.K. National Crime Agency’s National Cyber Crime Unit, stated, "Scattered Spider has posed the most significant cybercrime threat to the U.K. in recent years. This investigation has substantially disrupted that threat and held key offenders accountable." The cyberattack on TfL, which occurred in the summer of 2024, caused extensive disruptions, taking down critical infrastructure including ticketing systems and real-time train arrival information for weeks, inconveniencing thousands of commuters. Flowers and Jubair were apprehended a year later, following their identification by the NCA and City Police. At one point, the FBI implicated Jubair in attacks on over 120 companies through social engineering methods. The financial impact of the TfL breach was estimated at around £29 million (approximately $47 million). Authorities revealed that the hackers had gained such profound access to TfL’s systems that they could have completely disabled the organization, essentially holding "the keys to the kingdom."