Two teenage hackers could have caused a potential consequential loss of £56 billion to the UK economy after infiltrating Transport for London's (TfL) network, Woolwich Crown Court heard. Thalha Jubair, now 20, and Owen Flowers, 18, carried out the 'extremely serious hack' between August 31 and September 3, 2024, costing TfL £29 million.
How the Hack Unfolded
The pair, linked to the group Scattered Spider, worked through the night for 16 hours to access the network after tricking the helpdesk into resetting a password. They then used TfL's own systems to hack deeper, eventually obtaining the 'highest privileged access'—described as 'the keys to the kingdom'. Mark Fenhalls KC, prosecuting, said this gave them 'total control over the network' and would have enabled them to place ransomware throughout the entire system.
Potential Catastrophic Damage
Had they encrypted or destroyed the central TfL system, the potential consequential loss to the UK economy was estimated at £56 billion. A TfL victim impact statement read in court stated: 'It is possible that access could have been sufficient to enable the actor to cause catastrophic damage to many technology systems, which would have led to significant and extended transport service degradation and disruption. Such widespread disruption would have had a serious impact on the travelling public, including for those accessing education, healthcare and other essential services, and London’s economy.'
Response and Aftermath
TfL 'pulled the plug' on their whole system, fearing catastrophic damage. Every one of its more than 27,000 employees had to come into the office to reset their passwords. The pair created multiple back doors, downloaded millions of lines of data, and used remote servers to conceal the attack's origin. Flowers livestreamed the hack, and videos were recovered upon his arrest on September 6, 2024.
Legal Proceedings
Jubair and Flowers admitted conspiracy to commit unauthorised acts in relation to a computer causing or creating risk of serious damage. Flowers also admitted two counts of conspiracy to commit unauthorised acts in relation to a computer with intent to impair, concerning healthcare systems. Sentencing is scheduled for Thursday. Mr Fenhalls said: 'These two young men are highly skilled with computers and capable of wreaking havoc and you may think wholly indifferent to the consequences for the public and the potential suffering and costs to others.'
Defence Arguments
Defending Jubair, Paul Keleher KC compared his client to a 'modern day Oliver Twist' groomed from a young age. However, Mr Justice Turner rejected this, stating: 'There’s no Fagin in this case, it’s a Faginless crime.' He added: 'He has an audience but he doesn’t have a puppet master, he’s promoted himself to an instigator and perpetrator.' Jubair was previously sentenced for 22 offences including hacks on individuals, telecoms businesses, and the City of London Police system.
For Flowers, who was 17 at the time, Adam Davis KC described him as an 'immature child trying to show off online'. When arrested, his laptop was found in the process of hacking two US healthcare systems—hacks only stopped by the 'fortuitous timing' of his arrest. While in prison, Flowers purchased 'unlawful phones' and searched for logins to the Ministry of Justice, HMP Wandsworth staff, and the CPS.
Conclusion
Both defendants were placed on remand in September 2025. The court heard they were 'utterly reckless about the consequences of hacking TfL, the transport network and the communications for the country.' The prosecution stressed: 'This is hacking of the most serious sort with the ability to do remarkable levels of damage.'
