Two men who were teenagers when they carried out a devastating cyber-attack on Transport for London have been sentenced to five years and six months in prison — a punishment that reflects the scale of a hack that crippled the capital’s transport network for months.
Owen Flowers, now 18, from Walsall, and Thalha Jubair, now 20, from east London, pleaded guilty in June to the 2024 attack. Woolwich Crown Court heard they were part of the cyber crime collective Scattered Spider, described as computer-obsessed loners who streamed their 16-hour assault online.
“Two teen hackers jailed for 5.5 years over TfL cyber-attack costing £39m.”
Flowers was 17 and Jubair was 18 when they hacked into TfL’s systems at 5pm on 31 August. They gained access by tricking a phone help-desk worker into resetting the password of an employee they were impersonating. Once inside, they boasted in Telegram messages about accessing the database of Oyster card holders and searched for the personal details of London celebrities, before attempting to obtain banking information.
“Scattered Spider is creating webs on the London Underground,” Flowers later joked, referencing the loosely coordinated group of English-speaking hackers that has been linked to attacks on retailers Marks and Spencer and the Co-op.
The breach disrupted TfL’s online services for months, stole the personal data of millions of customers, and forced all 27,000 TfL employees to reset their passwords in person. The database — containing details of up to 10 million TfL customers — is still being shared among criminal groups, the BBC revealed.
TfL was alerted to the breach by the National Crime Agency and worked to eject the hackers, but not before the criminals had gained millions of people’s details. The transport authority said the hack could have caused widespread disruption had its IT team not logged out all staff and eventually disconnected TfL systems from the internet. In total, 148 technology systems became inoperable, heavily disrupting services including Dial-a-Ride, used by disabled and vulnerable Londoners.
The financial impact of the hack was £29m, TfL said, with an additional £10m in lost income — a combined cost of £39m.
Jubair and Flowers were arrested in moments captured on video released by the NCA. The NCA said the rise of young hackers in the UK is one of the biggest threats to the nation’s cyber security. In the last two years, young men and boys have been arrested for Scattered Spider hacks in the UK, US, Spain and Finland.
The sentencing sends a clear message about the consequences of such cyber crimes, but the ongoing circulation of stolen data raises questions about how secure customers’ information remains.
