Two teenagers who paralysed Transport for London (TfL) in a £29 million hack have been jailed for 11 years. Thalha Jubair, 19, and Owen Flowers, 18, spent six days inside TfL’s servers using log-ins of its chief information security officer after requesting a password reset. The pair infiltrated so deeply they obtained the highest privileged access, known as ‘the keys to the kingdom’.
Attack details and impact
The hack, which occurred between August 31 and September 3, 2024, stopped all contactless and Oyster payments, prevented live Tube information on TfL’s apps and website, and even allowed the pair to view celebrities’ accounts. TfL ‘pulled the plug’ on the entire system, resetting the passwords of all 27,000 staff. Prosecutor Mark Fenhalls KC called the TfL hack an ‘unprecedented attack on critical national infrastructure… remarkably sophisticated, on a grand scale’. He added: ‘The consequences were extremely serious, both in disruption to the public, and remedial work that occupied thousands of hours of work by many, many people, and ultimately cost the public purse £29 million.’ He also warned of a ‘potential consequential loss of £56 billion to the UK economy had they encrypted or destroyed OneLondon – a central TfL system they gained administrative rights’ to.
Sentencing and motivations
Judge Mr Justice Spencer jailed each of them for five and a half years, saying despite their relative youth and neurodiversity, the offending is ‘so serious that I have no alternative but to pass a sentence of immediate custody’. He told them: ‘I am satisfied that your actions were primarily motivated by selfless bravado, heedless of the severe consequences for others.’ Flowers, who lived with his grandma in Walsall, and Jubair, of Bow, east London, were part of the cyberhacking gang Scattered Spider, which made millions from blackmail, Woolwich crown court heard.
Broader criminal activities
The loosely organised gang of young mainly English-speaking cyber-criminals has been linked to dozens of other attacks, including high-profile hacks on Jaguar Land Rover, costing an estimated £1.9 billion, Marks and Spencer, and the Co-op. M&S was targeted in April last year, with the retailer shutting a raft of systems down on Easter Sunday. The company said the cyber-attack cost the firm around £300 million after it shut down its website for six weeks. Co-op saw payments disrupted and shelves left empty the following month, and hackers stole Co-op members’ personal data, such as names and contact details. Harrods also restricted internet access following attempts to gain unauthorised access, causing losses of £206 million.
Evidence and past offences
Mr Fenhalls said the pair filmed themselves hacking TfL, allowing investigators to see how they worked. At one stage they worked together continuously for 16 hours. Flowers and Jubair admitted conspiracy to commit unauthorised acts in relation to a computer and causing or creating a significant risk of serious damage to human welfare. Both have histories of cyber-related activity. At 16, Flowers was visited by a Cyber Choices preventive policing team in October 2023, where he was served with a cease and desist notice over ‘swatting’ – false 911 calls in the US to draw an armed police response. He declined to take part in a rehab programme. When arrested in 2024, he had no income but $7.1 million, including crypto, was in accounts he controlled. Jubair previously hacked BT, EE and computer chip giant Nvidia, and has convictions for 22 offences including 13 frauds. He was subject to a youth rehabilitation order at the time of the TfL offences and is also wanted in the US, where he faces up to 95 years in jail. At least $200 million in crypto was moved through his accounts in 2025. He was also convicted of stalking two young women at a youth court and hacking into a City of London Police server. Both defendants have been diagnosed with autism, while Jubair also suffers from depression and a severe mood disorder.
