News summary produced by Claude AI
Two hackers have been convicted and sentenced for a major cyberattack on Transport for London’s IT infrastructure that occurred between 31 August and 3 September 2024. Thalha Jubair, 20, and Owen Flowers, 19, each received sentences of five and a half years. Jubair was 18 at the time of the attack, while Flowers was 17.
The pair gained access to the heart of TfL’s systems by exploiting an unnamed co-conspirator who contacted the helpdesk with stolen credentials. A handler was deceived into resetting authentication to a device controlled by the hackers, allowing them to escalate their privileges to the highest level of system access. While the main tube and bus networks continued operating, the dial-a-ride service for disabled passengers could not process bookings during the incident. According to prosecutors, the hackers possessed “the keys to the kingdom” and could have completely shut down TfL’s systems. The attack resulted in data theft affecting approximately 7 million people and caused £39 million in losses, comprising £29 million in IT system damage and £10 million in lost revenue.
Both individuals were members of Scattered Spider, a loose collective of English-speaking hackers suspected of numerous cybercrimes. The National Crime Agency stated that their convictions had “effectively halted the group’s criminal activity.” The pair had accumulated millions of dollars in cryptocurrency through their activities, though neither displayed lavish spending patterns. Court proceedings revealed that Jubair had prior convictions for 22 offences as a teenager, while Flowers had previous contact with authorities.
During sentencing at Woolwich Crown Court, Mr Justice Turner characterised the attack as “primarily motivated by selfish bravado, heedless of the severe consequences to others.” Both defendants were diagnosed with autism, with Jubair also suffering from depression and a severe mood disorder. Their defence counsel presented evidence of difficult childhoods marked by isolation and vulnerability. TfL’s head, Andy Lord, described the incident as the worst cyber attack he had encountered in his career.