TfL Hackers Owen Flowers, Thalha Jubair Get 5.5-Year Terms Over £29 Million Attack
Updated
Updated · bbc.co.uk · Jul 16
TfL Hackers Owen Flowers, Thalha Jubair Get 5.5-Year Terms Over £29 Million Attack
3 articles · Updated · bbc.co.uk · Jul 16
Summary
Five years and six months in prison were handed to Owen Flowers, 18, and Thalha Jubair, 20, after they admitted carrying out the 2024 cyber-attack that crippled Transport for London.
TfL said the breach stole data from as many as 10 million customers, knocked 148 technology systems offline and forced all 27,000 staff to reset passwords after the pair tricked a help-desk worker into resetting an employee account.
£29 million is now TfL's estimated cost of the attack, revised down from £39 million, after online services were disrupted for months and Dial-a-Ride was heavily affected.
Court evidence showed the pair, linked to Scattered Spider, streamed the 16-hour attack, searched Oyster-card records for celebrities and kept discussing future hacks from prison using contraband phones.
The NCA said the case underscores the growing threat from young UK-based hackers, though one analyst warned the sentences alone are unlikely to deter copycats.
With £1 million in crypto seized, was the TfL hack about notoriety or the rise of a new teenage cyber-millionaire class?
Jailed for a massive hack, they planned more attacks from prison. Can the justice system handle criminals who operate without borders?
If a phone call can cause a £29 million shutdown, can prison sentences alone protect our critical infrastructure from teenage hackers?
£6.6 Billion TfL Cyberattack: The Rise of Scattered Spider, Youth Offenders, and the Urgent Need for Stronger Cybercrime Intervention
Overview
The July 2026 verdict against Owen Flowers and Thalha Jubair marks a turning point in the fight against cybercrime, highlighting how early warnings can fail to stop escalation. Flowers, first given a cease and desist order for minor cyber offenses in October 2023, continued to commit more serious crimes, including attacks on US health systems and the major 2024 Transport for London hack. Despite intervention, he was apprehended while actively hacking, with investigators seizing multiple devices. This case exposes the urgent need for stronger youth cybercrime prevention, as repeated offenses led to severe disruption and financial loss for critical infrastructure.