For four days in 2024, two teenage hackers held London’s transport network hostage. Thalha Jubair, then 18, and Owen Flowers, 17, had burrowed into the heart of Transport for London’s IT systems, creating a “domain admin” account that gave them “the keys to the kingdom”, Woolwich Crown Court was told. They streamed their 16-hour cyber-attack online, boasting on Telegram about gaining access to TfL’s database of Oyster card holders, searching for the personal details of London celebrities and attempting to access banking information.
The attack, which began at 5pm on 31 August and lasted until 3 September, disrupted TfL’s online services for months, stole the personal data of millions of customers, and forced all 27,000 TfL employees to reset their passwords in person. TfL was alerted by the National Crime Agency and eventually “pulled the plug” on its systems, disconnecting them from the internet. But by then, 148 technology systems were inoperable, heavily disrupting services including Dial-a-ride for disabled and vulnerable Londoners. TfL estimates the financial impact at £29m, plus £10m in lost income – a total of £39m.
“Two teenage hackers jailed for five years each after crippling Transport for London in a 2024 cyber-attack costing £39m.”
The two hackers, described by the court as computer-obsessed loners, were part of the cybercrime collective Scattered Spider, which has been linked to dozens of other attacks on retailers such as Marks & Spencer and the Co-op. They gained access by tricking a phone help desk worker into resetting an employee’s password. Once inside, they could have “shut out and shut down TfL completely”, prosecutors said. TfL’s head, Andy Lord, a veteran of British Airways, called it the worst incident he had faced in his career.
Jubair, 20, lived with his parents in a council flat in Bow, east London; Flowers, 19, lived with his grandmother and uncle in Walsall. They communicated via Telegram, and Flowers recorded a livestream of the hack. Sentencing them each to five years and six months, Mr Justice Turner said the attack was “primarily motivated by selfish bravado, heedless of the severe consequences to others”. Flowers also received the same sentence for hacking two US healthcare providers.
Both pleaded guilty in June. The National Crime Agency said the rise of young hackers in the UK is one of the biggest threats to the nation’s cyber security. As revealed by the BBC, the stolen database – containing details of as many as 10 million TfL customers – is still being shared in criminal groups.
