business
Two men convicted in 2024 Transport for London cyber-attack
Owen Flowers and Thalha Jubair pleaded guilty to carrying out the attack that disrupted TfL services for months. Both had prior cyber-offending records and were known to police before the breach.
Jun 25, 7:19 PM·1m read1 source
Audio version
Tap play to generate a narrated version.
Developing·Limited corroboration so far. This page will refresh as more sources emerge.
Two men convicted for their roles in the 2024 cyber-attack on Transport for London had been known to police for years before the incident. Owen Flowers, 18, from Walsall, and Thalha Jubair, 20, from east London, pleaded guilty on Monday to carrying out the attack.
The breach disrupted TfL services for months, affected the personal data of millions of people and required all 28,000 TfL employees to reset their passwords in person.
In October 2023 he received a cease and desist order after low-level cyber activity. Officers considered but did not enrol him in a national programme aimed at diverting young people from cyber-crime. Jubair had received a Youth Rehabilitation Order in 2023 for offences linked to the Lapsus$ group while still a juvenile.
Court records show he has 22 previous convictions and began offending at age 14.
arrests Flowers was arrested on 16 September 2024.
Investigators seized multiple devices and discovered cryptocurrency holdings worth millions of pounds. Officers also found evidence that systems belonging to two U.S. healthcare organisations had been infiltrated. Jubair is wanted in the U.S. in connection with alleged cyber-crimes that stole and extorted $87 million from victims.
Flowers is also wanted in the U.S. for offences relating to the healthcare breaches. Flowers breached bail conditions twice after his arrest. Both men are due to be sentenced on 16 July.
