Two Hackers Sentenced to Five Years Six Months Each for Transport for London Cyber Attack

Owen Flowers, 18, and Thalha Jubair, 20, each received sentences of five years and six months at Woolwich Crown Court after pleading guilty in June to carrying out a cyber attack on Transport for London that began on 31 August 2024. The attack disabled 148 technology systems, forced all 27,000 TfL employees to reset passwords in person, and exposed the personal data of millions of customers.

TfL reported the incident cost the authority £29 million.

Flowers, who was 17 at the time, and Jubair, who was 18, were members of the Scattered Spider cyber-crime group and streamed the 16-hour intrusion online. Court records showed Flowers had received a cease-and-desist order in 2023 and was arrested while hacking two U.S. healthcare providers.

Jubair had 22 previous convictions for hacking, fraud and harassment, received a Youth Rehabilitation Order in 2023 for offences linked to the Lapsus$ group, and is wanted in the United States in connection with alleged ransom demands totaling $115 million.

The National Crime Agency said the pair gained access by impersonating an employee and convincing a help-desk worker to reset a password. TfL was alerted by the agency and disconnected systems from the internet to stop further access.

“The case illustrates the risks posed by young hackers operating from home." — NCA deputy director Paul Foster Cyber-security analyst Allison Nixon stated that arrests alone would not deter others and called for broader policy responses. The database containing up to 10 million customer records remains shared among criminal groups.”