Two men who carried out a cyber-attack that crippled Transport for London (TfL) when they were teenagers have been sentenced to five years and six months in prison. Owen Flowers, 18, from Walsall, and Thalha Jubair, 20, from east London, pleaded guilty in June to the 2024 hack, which the National Crime Agency (NCA) described as part of a rising threat from young hackers in the UK.
Woolwich Crown Court heard the pair streamed their 16-hour attack online as they targeted TfL's systems on the evening of 31 August. Flowers was 17 and Jubair 18 at the time. They gained access by tricking a phone help desk worker into resetting the password of an employee they were impersonating. Telegram messages later showed them boasting about accessing TfL's database of Oyster card holders, searching for the personal details of London celebrities and attempting to obtain banking information.
“Two teen hackers who disrupted TfL and stole millions of data records jailed for five and a half years.”
"Scattered Spider is creating webs on the London Underground," Flowers would later joke, referring to the loosely coordinated cyber crime collective of which they were part. The group has been linked to dozens of other attacks, including on retailers Marks and Spencer and the Co-op. In the last two years, young men and boys have been arrested for Scattered Spider hacks in the UK, US, Spain and Finland.
The attack disrupted TfL's online services for months, stole the personal data of millions of people, and forced all 27,000 employees to reset their passwords in person. As revealed by the BBC, the database – containing details of up to 10 million TfL customers – is still being shared in criminal groups. TfL said the hack could have caused widespread disruption had its IT team not logged out all staff and eventually disconnected systems from the internet. In total, 148 technology systems became inoperable, heavily disrupting services including Dial-a-ride, used by disabled and vulnerable Londoners.
The financial impact of the hack was £29m, with an additional £10m in lost income, TfL estimates. Woolwich Crown Court heard that both men were computer-obsessed loners with few offline friends.