Two teenagers who livestreamed a 16-hour cyber-attack on Transport for London that crippled its systems, stole millions of commuters’ data and cost the authority £29m have been jailed for five and a half years each.
Thalha Jubair, 20, from east London, and Owen Flowers, 18, from Walsall, burrowed into the heart of TfL’s IT systems over four days in August and September 2024, obtaining what prosecutors called “the keys to the kingdom” – the highest privileged access. They could have “shut out and shut down TfL completely”, the court heard.
“Two teenage hackers who livestreamed a £29m cyber-attack on Transport for London jailed for five and a half years each.”
The pair tricked a phone help-desk worker into resetting the password of an employee they were impersonating, then logged on to Microsoft Azure and “using TfL’s own systems to hack itself”. As they moved through the network, Flowers livestreamed Jubair conducting the hack; some of the videos were recovered when Flowers was arrested three days later.
TfL was forced to “pull the plug” on its systems, logging out all staff and disconnecting from the internet. All 27,000 employees had to attend an office in person to reset their passwords. Payment systems for Oyster and contactless were knocked offline, live Tube information stopped updating, and the Dial-a-Ride service for disabled passengers was unable to process bookings for a period. The data of millions of customers was stolen, and the pair searched the database for London celebrities, attempting to access banking details.
Prosecutor Mark Fenhalls KC told Woolwich Crown Court the attack was “extremely serious”, “remarkably sophisticated” and “on a grand scale”, adding: “These two young men are highly skilled with computers and capable of wreaking havoc and you may think wholly indifferent to the consequences for the public.” TfL put the total cost at £29m in disruption and operational work, plus £10m in lost income – and prosecutors warned of a potential £56bn loss if the hackers had encrypted or destroyed OneLondon, a central TfL system they had accessed.
Jubair and Flowers, both of whom have autism, pleaded guilty in June. On Thursday, Mr Justice Turner sentenced each to five years and six months, telling them: “I’m satisfied that your actions were primarily motivated by selfish bravado heedless of the consequences on others.”
The pair were members of the Scattered Spider collective, a loosely coordinated group of young English-speaking hackers linked to attacks on Marks and Spencer, the Co-op and Jaguar Land Rover. At one point during the hack, Flowers joked: “Scattered Spider is creating webs on the London Underground.”
TfL’s chief, Andy Lord, called the incident the worst he had faced in his career. The authority said it could have caused “catastrophic damage” and “significant and extended transport service degradation and disruption” had its IT team not stopped the hackers in time.