Teenage Hackers Sentenced for Crippling Transport For London Cyber-Attack

Two men who carried out a cyber-attack which crippled Transport For London (TfL) when they were teenagers have both been sentenced to five years and six months in prison.

Owen Flowers, 18, from Walsall, and Thalha Jubair, 20, from east London, pleaded guilty in June to carrying out the hack in 2024.

They were described as computer-obsessed loners who carried out the hack as part of the cyber crime collective known as Scattered Spider.

The cyber-attack disrupted TfL's online services for months, stole the personal data of millions of people and left all 27,000 TfL employees needing to reset their passwords in person.

Woolwich Crown Court heard the criminals streamed their 16 hour long cyber-attack online.

The National Crime Agency (NCA) said the rise of young hackers in the UK as one of the biggest threats to the nation's cyber security.

Flowers was 17 and Jubair was 18 when they hacked into the capital's transport authority at 1700 on 31 August.

Telegram messages sent between the pair showed them boasting about gaining access to TfL's database of people with Oyster cards.

The teens then searched the list for the personal details of London celebrities, before attempting to access banking details.

"Scattered Spider is creating webs on the London Underground," Flowers would later joke - referring to the loosely coordinated group of young English-speaking hackers.

The group has been linked to dozens of other cyber-attacks including on retailers Marks and Spencer and the Co-op.

In the last two years young men and boys have been arrested for Scattered Spider hacks in the UK, US, Spain and Finland.

The TfL hack saw the data of millions of customers stolen in a spree which started on a Saturday night to maximise their chances of not being discovered by staff.

As revealed by the BBC, the database is still being shared in criminal groups and contains the details of as many as 10 million TfL customers.

Jubair and Flowers, gained access to the data by tricking a phone help desk worker.

They convinced the person to reset the password of an employee they were impersonating.

TfL was alerted to the breach by the NCA and worked to kick the hackers out - but not before the criminals gained the details of millions of people.

The transport authority said the hack could have caused widespread disruption had its IT team not stopped the hackers by logging out all staff - and eventually disconnecting TfL systems from the internet.

In total, 148 technology systems became inoperable and heavily disrupted services including Dial-a-ride - used by disabled and vulnerable Londoners.

TfL says the financial impact of the hack was £29m - in addition it estimates that the incident cost £10m in lost income.

Woolwich Crown Court heard both men were loners who had few offline friends, and spent most of their time online unsupervised.

Judge Mr Justice Turner cited their young age and autism diagnoses as mitigating factors in his sentencing remarks.

Police say Flowers rarely left his house and spent most of his time in his bedroom using his computer.

As previously revealed by the BBC, he had first been given a cease and desist order for minor cyber crime in October 2023 shortly after he turned 16.

A few months later the teenager, who was living with his grandmother and uncle, committed a series of cyber offences.

Flowers was eventually arrested in September 2024 in connection with the TfL attack.

Video of his arrest shows the teenager laughing as he is taken into custody.

In the arrest raid, investigators caught Flowers in the act of hacking two US healthcare providers.

Messages he sent showed him joking about the hacks potentially "killing a 90-year-old on life support".

He pleaded guilty to offences relating to those hacks, along with the TfL cyber-attack.

Police also seized cryptocurrency holdings worth around £1m.

Although Flowers and Jubair were said to have accumulated millions of pounds in stolen or ransomed cryptocurrency, police say their motives were likely about online notoriety more than financial gain.

Like Flowers, Jubair had been known to police for years.

Woolwich Crown Court heard that whilst in prison awaiting trial, both Jubair and Flowers were discovered with contraband phones.

Recovered messages show the men continuing to discuss and coordinate future cyber-attacks.

After the sentencing NCA deputy director Paul Foster, head of its National Cyber Crime Unit, said the case highlighted the challenges posed by home grown hackers.

"The online world can expose young people to harmful influences and criminal communities far beyond their front door," he said.

"Parents, carers, educators, technology companies and law enforcement, the whole of society, we all have a role to play in helping to keep young people safe online.

He claimed Scattered Spider was "heavily degraded and disrupted" as a result of the arrests, but cyber security analyst Allison Nixon said it would do little to put off young boys from cyber crime.

"Policymakers need to address this as a violent youth gang problem, with a gang culture that idolizes the destruction of society and maximising victim harm," she said.