Two teenage hackers who caused catastrophic damage to Transport for London (TfL) from their bedrooms have been jailed for five and a half years. Thalha Jubair, 20, and Owen Flowers, 18, admitted conspiracy to commit unauthorised acts in relation to a computer, causing or creating risk of serious damage. The attack, which took place between August 31 and September 3, 2024, cost TfL £29 million and compromised the data of seven million commuters.
The Attack on TfL
The hackers gained access to TfL's systems by tricking the helpdesk into resetting a password for a stolen login. They then logged onto Microsoft Azure and used TfL's own systems to escalate privileges, creating multiple back doors and downloading millions of lines of data. The 16-hour hack was livestreamed online, halting live Tube arrival times on the TfL Go app, stopping Oyster and contactless payments, and rendering 148 technology systems inoperable. Services for disabled passengers, such as Dial-a-Ride, were heavily disrupted.
Prosecutor Mark Fenhalls KC said the hackers had unlocked the "highest privileged access" in the system, known as "the keys to the kingdom," and could have shut down TfL completely. A TfL victim impact statement read in court noted that such access could have caused "catastrophic damage" to technology systems, leading to "significant and extended transport service degradation and disruption."
The Hackers' Backgrounds
Jubair lived with his parents in a council flat in Bow, east London, while Flowers lived with his grandmother and uncle in Walsall, West Midlands. Both were avid gamers and spent most of their time in their bedrooms. Jubair was taught to use a smartphone at age four, given a laptop at six, writing computer programs by 10, and hacking by 13. He was convicted of 22 offences as a teenager, including fraud, unauthorized computer access, and blackmail. He is also wanted in the US for cyber crimes against 47 victims, allegedly leading to $115 million in ransoms.
Flowers was known to police since age 16 and had been served a cease-and-desist notice for hoax calls. He turned down an offer of training to guide him away from cybercrime after his arrest in September 2024, when his laptop was found hacking two US healthcare systems. Both defendants have been diagnosed with autism; Jubair also has depression and a severe mood disorder.
The Scattered Spider Connection
The pair were part of a loose collective of hackers known as Scattered Spider, suspected of cyberattacks on Jaguar Land Rover and Marks & Spencer. At the height of their crimes, they earned millions in cryptocurrency. $10 million was moved from Jubair's crypto wallets after his release from custody in March 2024, and $200 million worth of crypto had moved through his accounts. Flowers had $7.1 million in accounts despite having no source of income.
Their participation in Scattered Spider may have earned them millions, but their convictions have "effectively halted the group's criminal activity," according to the National Crime Agency (NCA). The NCA said the rise of young hackers in the UK is one of the biggest threats to the nation's cyber security.
Sentencing and Impact
Sentencing the pair at Woolwich Crown Court, Mr Justice Turner said the attack was "primarily motivated by selfish bravado, heedless of the severe consequences to others." Along with the £29 million in damages, TfL reported £10 million in lost income. The court heard that the hackers could have caused "catastrophic damage" and that their actions were "extremely serious."
Defending Jubair, Paul Keleher KC compared his client to a "modern day Oliver Twist" who had been groomed from a young age to use his skills for hacking. He said: "They recruited young children to use their nimble fingers and nimble feet to steal from people."
