Two Teen Hackers Behind $37M TfL Attack Get 5.5 Years Each

Robert Moore · 2026-07-16

### The Verdict That Shook the Cybercrime World Two young hackers, part of the notorious Scattered Spider group, just got handed a reality check. Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years in prison on July 16, 2026, at Woolwich Crown Court. Their crime? A devastating 2024 hack of Transport for London (TfL) that cost an estimated $37 million. This wasn't some small-time operation. The attack left 148 TfL systems completely inoperable. And here's the kicker: all 27,000 TfL employees had to physically report to an office just to reset their passwords. Imagine that chaos. ### How the Attack Unfolded The hackers didn't use some fancy zero-day exploit. They relied on classic social engineering tactics to get inside TfL's network. Once in, they moved laterally, compromising critical systems that manage London's tube, buses, and trains. For a transport network that serves millions daily, this was a nightmare. The National Crime Agency (NCA) and the Crown Prosecution Service (CPS) both worked tirelessly to bring these two to justice. They estimated TfL's total losses and recovery costs at $37 million. ### Why This Matters for Antidetect Browser Users If you're using antidetect browsers for legitimate privacy reasons, cases like this hit close to home. The tools we use to protect our digital identities can also be weaponized by bad actors. Flowers and Jubair likely used proxy chains and browser fingerprint spoofing to cover their tracks. But here's the truth: law enforcement is getting smarter. They're now tracking cryptocurrency transactions and collaborating across borders like never before. The days of thinking you're untouchable are fading fast. ### What TfL Did Right After the Hack - **Immediate lockdown**: They isolated affected systems within hours. - **Mandatory password reset**: All 27,000 employees had to come in person to reset credentials. - **Forensic investigation**: They worked with the NCA and CPS to trace every move the hackers made. - **System upgrades**: TfL invested heavily in modernizing their IT infrastructure. ### Lessons for Digital Privacy Professionals This case is a wake-up call for anyone working in digital privacy or antidetect technology. Here's what you should take away: - **Legal consequences are real**: Even young hackers face serious prison time. - **Your digital footprint matters**: No matter how good your browser spoofing is, there's always a trail. - **Legitimate use is key**: Antidetect browsers are amazing for protecting your privacy online. But using them for illegal activities will eventually catch up with you. ### The Bigger Picture The Scattered Spider group has been responsible for some of the most high-profile cyberattacks in recent years. They're known for targeting critical infrastructure and demanding huge ransoms. But this sentencing shows that law enforcement is finally catching up. For the rest of us, it's a reminder to stay vigilant. Whether you're running a business or just browsing the web, cybersecurity isn't optional anymore. It's a necessity. ### Final Thoughts Flowers and Jubair thought they were clever. They thought they could hide behind proxies and fake identities. But they were wrong. Their 5.5-year sentences are a stark warning to anyone considering using antidetect browsers for malicious purposes. If you're using these tools for legitimate privacy protection, keep doing what you're doing. Just remember: with great power comes great responsibility.