The National Crime Agency (NCA) has announced that Thalha Jubair, from East London, and Owen Flowers, from Walsall, West Midlands, both leading members of the Scattered Spider cybercriminal collective, were each sentenced to five years and six months imprisonment on 16 July 2026 at Woolwich Crown Court. Both pleaded guilty on 22 June 2026 to hacking Transport for London's (TfL) network between 31 August 2024 and 3 September 2024, in only the second UK prosecution under section 3ZA of the Computer Misuse Act 1990. The individuals were arrested on 16 September 2024 by the NCA and City of London Police. TfL reported £29 million in losses and recovery costs, with 148 systems rendered inoperable, all 27,000 employees required to attend offices for mandatory password resets and data from its Oyster refunds system accessed. Disrupted services included Dial-a-Ride, concessionary travel cards and digital payments.