Thalha Jubair and Owen Flowers, members of a hacking collective known as Scattered Spider, gained access to the core systems of Transport for London between 31 August and 3 September 2024. The pair obtained what prosecutors described as “the keys to the kingdom” by achieving the highest level of system access and creating administrative accounts that could have potentially shut down the entire network. The attack disrupted services including the dial-a-ride booking system for disabled passengers, prevented real-time tube arrival information from displaying, and disabled payment processing on Oyster and contactless card systems.
The breach resulted in significant financial and operational consequences for TfL. The attack cost the organization £39 million, comprising £29 million in damage to IT infrastructure and £10 million in lost revenue. Data belonging to approximately 7 million commuters was stolen during the incident. TfL’s leadership described the attack as the most serious security incident the organization had faced, warning it could have caused catastrophic damage and extended service disruption.
The two hackers conducted the attack from their residences: Jubair, 20, from a council flat in east London, and Flowers, 19, from a property in the West Midlands. They communicated through encrypted messaging and Flowers even livestreamed portions of the attack. Both defendants pleaded guilty in June and received identical sentences of five and a half years at Woolwich Crown Court. Justice Turner characterized the attack as motivated by “selfish bravado, heedless of the severe consequences to others.”
Both individuals had prior involvement in cybercriminal activity and came from challenging backgrounds. Jubair had been convicted of 22 offences as a teenager and showed early aptitude for computing from childhood. Flowers had experienced significant isolation and was 17 at the time of the TfL hack. Court proceedings revealed both had autism diagnoses, with Jubair also experiencing depression and severe mood disorder. The National Crime Agency indicated that the convictions had substantially disrupted the Scattered Spider collective’s operations.
Originally reported by The Guardian. Read the full story →