Two Young Hackers Jailed for Five-and-a-Half Years Each Over Major TfL Cyber Attack
Two teenagers who carried out a sophisticated cyber attack on Transport for London (TfL) systems have been sentenced to five years and six months in prison.
Thalha Jubair, 20, from east London, and Owen Flowers, 18, from Walsall, pleaded guilty in June to the August 2024 hack that caused widespread disruption across London’s transport network. They were sentenced today at Woolwich Crown Court.
How the Hack Unfolded
On the evening of 31 August 2024, the pair — then aged 18 and 17 — gained unauthorised access to TfL’s systems by impersonating an employee and tricking a phone helpdesk worker into resetting a password.
They began the attack on a Saturday night to reduce the chance of immediate detection and then live-streamed the 16-hour intrusion to an online audience. During the breach they accessed TfL’s database containing personal details of millions of customers, including Oyster card records, and searched for information on high-profile Londoners.
The attack was linked to the loosely organised English-speaking hacking collective known as Scattered Spider.
Massive Disruption and £29 Million Cost
TfL was forced to take drastic action, logging out all staff and disconnecting systems from the internet to contain the breach. The incident rendered 148 technology systems inoperable and heavily disrupted services, including the Dial-a-Ride scheme used by disabled and vulnerable Londoners.
All 27,000 TfL employees had to reset their passwords in person. The personal data of up to 10 million customers was stolen, with some of the Oyster card information later appearing in criminal circles. The total cost to TfL has been put at £29 million.
Backgrounds of the Hackers
Both men were described in court as computer-obsessed loners with autism who spent most of their time online.
• Thalha Jubair had 22 previous convictions for hacking, fraud and harassment. He was first arrested at 14 and was previously linked to the Lapsus$ hacking group. He had been interacting with criminal hackers online since the age of 13.
• Owen Flowers had a cease-and-desist order for minor cyber offences in 2023. He was also caught hacking two US healthcare providers around the time of his arrest in September 2024. Police seized cryptocurrency worth around £1 million from him.
Police and prosecutors said the primary motive appeared to be gaining online notoriety rather than pure financial gain, although both had accumulated significant cryptocurrency holdings.
A video shared alongside news of the sentencing shows police mugshot-style images of the two men alongside footage of an arrest operation involving City of London Police and the National Crime Agency (NCA). Officers are seen leading individuals to a police van, with some faces blurred for legal reasons.
Official Reaction
NCA Deputy Director Paul Foster said after the sentencing:
“The online world can expose young people to harmful influences and criminal communities far beyond their front door. Parents, carers, educators, technology companies and law enforcement — the whole of society — we all have a role to play in helping to keep young people safe online.”
Cyber security analyst Allison Nixon described the rise of young hackers in groups like Scattered Spider as “a violent youth gang problem” that idolises causing maximum harm.
The NCA stated that operations against Scattered Spider have “heavily degraded and disrupted” the group in recent years, with arrests also made in the US and Finland.
This case highlights the growing threat posed by young, technically skilled hackers operating in online communities that reward disruption and notoriety. Both Jubair and Flowers will now serve their sentences in prison.
