Two teenage hackers who gained access to the heart of London's transport network have been sentenced to five and a half years in prison. Thalha Jubair, 20, and Owen Flowers, 19, pleaded guilty to a cyber-attack on Transport for London (TfL) that occurred between 31 August and 3 September 2024. The attack cost TfL £39 million, comprising £29 million in damage to IT systems and £10 million in lost income. Data from approximately 7 million people was stolen, and 27,000 TfL staff were forced to reset their passwords.
Attack Details and Impact
Jubair and Flowers burrowed into TfL's IT systems, achieving the highest privileged access and creating a domain admin account described in court as "the keys to the kingdom." While main tube and bus networks were not directly affected, the dial-a-ride service for disabled passengers was unable to process bookings for a period. The attack also prevented live tube arrival information from appearing on the TfL Go app and website, and TfL was unable to process any payments on the Oyster and contactless apps or register Oyster cards to customer accounts.
TfL head Andy Lord described the attack as the worst incident he had faced in his career. TfL stated the attack could have caused "catastrophic damage" to its technology systems and led to "significant and extended transport service degradation and disruption." The duo were only stopped when TfL effectively "pulled the plug" on its systems.
Sentencing and Background
Sentencing at Woolwich Crown Court, Mr Justice Turner said the attack was "primarily motivated by selfish bravado, heedless of the severe consequences to others." Jubair, from Bow, east London, lived with his parents in a council flat. Flowers, from Walsall, West Midlands, lived with his grandmother and uncle. Both were key figures in the hacking group Scattered Spider, and their activities had accrued millions of dollars in cryptocurrency. The National Crime Agency said the convictions "effectively halted the group's criminal activity."
Jubair had 22 prior convictions as a teenager, including fraud, unauthorized computer access, and blackmail. He was 18 at the time of the TfL hack. Flowers was 17. Both have been diagnosed with autism; Jubair also has depression and a severe mood disorder. The court heard that Jubair was introduced to hacking at age 13, while Flowers spent most of his time gaming.
How the Hack Occurred
The pair gained access via an unnamed co-conspirator who called the TfL help desk with stolen login details, pretending to be an employee struggling to access the network remotely. A call handler was tricked into resetting the authentication process to a device controlled by Jubair and Flowers. They then escalated their access. During the attack, Flowers messaged Jubair: "u won't be laughing when ur sat in prison."
Despite not being a ransomware attack, the hackers had access to vast sums of money. A previous hearing revealed that $10 million was moved from Jubair's crypto wallets after his release from custody, and $200 million worth of crypto moved through accounts belonging to him. Flowers held $7.1 million in accounts he controlled, despite having no source of income. Neither appeared to have a lavish lifestyle; Flowers used crypto for food deliveries, while Jubair paid for food with gift cards bought using crypto from accounts allegedly storing ransomware payments.
