Two "talented" hackers who caused a £29 million cyberattack on Transport for London (TfL) have been sentenced to five years and six months in prison. Thalha Jubair, 20, and Owen Flowers, 18, carried out an "extremely serious hack" on TfL's online network between August 31 and September 3, 2024, which could have led to "catastrophic damage" according to prosecutors.
Attack Details and Impact
The hack forced TfL to "pull the plug" on its systems at significant cost. Data from the Oyster refund system was accessed, contactless payment systems were delayed, and applications for Oyster photocards for children and young people were suspended. Additionally, all of TfL's more than 27,000 employees were required to attend an office in person to reset their passwords. The attack disrupted services and incurred substantial financial losses for the transport authority.
Sentencing and Background
Both defendants were teenagers at the time of the attack. The court handed down identical sentences of five years and six months. The judge described the hack as an "extremely serious" breach that could have caused catastrophic consequences had it gone further. The case highlights the growing threat of cybercrime and the severe penalties for such offenses.
