Two individuals, Owen Flowers and Thalha Jubair, received identical prison sentences following their involvement in a significant cyber-attack targeting Transport For London. Flowers, now 18 and from Walsall, and Jubair, 20 and from east London, pleaded guilty in June to carrying out the hack. At the time of the incident, Flowers was 17 and Jubair was 18 when they accessed TfL systems on 31 August.
The attack caused extensive disruption to the transport authority’s operations, rendering 148 technology systems inoperable and affecting services such as Dial-a-ride, which serves disabled and vulnerable residents. The breach compromised personal data belonging to approximately 10 million TfL customers, with the stolen database subsequently circulating among criminal organizations. The pair obtained unauthorized access by deceiving a help desk worker into resetting an employee’s password. The incident resulted in financial losses totaling £39 million when combining direct costs and lost revenue.
Both perpetrators were associated with Scattered Spider, a loosely coordinated international cyber crime collective. The pair live-streamed their 16-hour attack and were discovered exchanging messages boasting about accessing Oyster card customer databases and searching for details of London celebrities. Court proceedings revealed that both individuals exhibited characteristics of social isolation, spending extensive time online with minimal in-person social connections. Judge Mr Justice Turner considered their youth and autism diagnoses when determining sentences.
Flowers had previously received a cease and desist order for minor cyber offenses and was arrested in September 2024 while actively hacking US healthcare providers. Investigators recovered approximately £1 million in cryptocurrency during the arrest. Jubair had an extensive history with law enforcement, including prior convictions related to involvement with the Lapsus$ cyber crime group, and faces additional charges in the United States connected to cyber crimes affecting 47 victims. The National Crime Agency emphasized that young hackers represent an escalating threat to national cyber security infrastructure.