Two teenagers have been jailed for five years and six months for orchestrating Britain's largest cyber attack, which targeted Transport for London (TfL) and caused nearly £30 million in losses. Thalha Jubair, now 20, and Owen Flowers, now 18, infiltrated TfL's computer network between 31 August and 3 September 2024, disrupting services for months and stealing personal data of millions of customers.
Attack Details and Impact
The pair, described as "computer-obsessed loners," were members of the global cybercrime collective Scattered Spider. They gained access by tricking a phone help desk worker into resetting an employee's password. The attack began on a Saturday night to minimize detection. They streamed the 16-hour hack online and boasted on Telegram about accessing TfL's Oyster card database, searching for personal details of London celebrities and attempting to access banking information.
The breach rendered 148 technology systems inoperable, heavily disrupting services including Dial-a-Ride, used by disabled and vulnerable Londoners. TfL confirmed the hack cost at least £29 million. All 27,000 TfL employees had to reset their passwords in person. The stolen database, containing details of up to 10 million customers, continues to be shared among criminal groups.
Background of the Offenders
Both Jubair and Flowers have autism and were described as loners with few offline friends. Flowers rarely left his bedroom at his grandmother's home in Walsall, spending most of his time online. Police found him laughing during arrest while hacking two US healthcare providers; he joked about potentially "killing a 90-year-old on life support." Jubair, from Bow, east London, lived with his parents who migrated from Bangladesh. His defense claimed he was groomed by older cyber criminals, but he is wanted in the US for cyber crimes against 47 victims, allegedly leading to $115 million in ransoms.
Continued Criminal Activity
While in prison awaiting trial, both were found with contraband phones, with messages showing they continued to discuss and coordinate future cyber attacks. Police seized cryptocurrency holdings worth around £1 million, though authorities believe their primary motive was notoriety rather than financial gain.
Law Enforcement Response
NCA deputy director Paul Foster, head of the National Cyber Crime Unit, said: "The online world can expose young people to harmful influences and criminal communities far beyond their front door. Parents, carers, educators, technology companies and law enforcement, we all have a role to play in helping to keep young people safe online." He insisted Scattered Spider had been "heavily degraded and disrupted" by the arrests.
However, cyber security analyst Allison Nixon warned: "Policymakers need to address this as a violent youth gang problem, with a gang culture that idolizes the destruction of society and maximising victim harm."
