Teen Hackers Jailed for TfL Cyber-Attack and Data Theft

Two young men have been sentenced to five years and six months in prison for a significant cyber-attack that crippled Transport For London's online services and compromised the personal data of millions. Owen Flowers, 18, and Thalha Jubair, 20, pleaded guilty to the hack, which they carried out in 2024 when they were still teenagers. Described as "computer-obsessed loners," they were part of a cybercrime collective known as Scattered Spider. The 16-hour attack not only disrupted TfL's operations for months but also led to the theft of personal data from as many as 10 million customers. All 27,000 TfL employees were required to reset their passwords in person. The National Crime Agency highlighted the growing threat posed by young hackers in the UK. Flowers, then 17, and Jubair, then 18, boasted in Telegram messages about accessing TfL's Oyster card database and searching for personal details of London celebrities. They also attempted to access banking information. The group has been linked to numerous other cyber-attacks, including those on retailers like Marks and Spencer and the Co-op. The TfL hack began on a Saturday night to minimize the chances of detection. Jubair and Flowers, both diagnosed with autism, gained initial access by impersonating an employee and tricking a phone help desk worker into resetting a password. TfL was alerted by the NCA and worked to expel the hackers, but not before substantial data was stolen. The transport authority stated the hack could have caused widespread disruption if its IT team had not intervened by logging out all staff and disconnecting systems from the internet. In total, 148 technology systems were rendered inoperable, heavily impacting services like Dial-a-ride, which serves disabled and vulnerable Londoners. The hack cost TfL an estimated £29 million. The court heard that both men had few offline friends and spent most of their unsupervised time online.

“

Scattered Spider is creating webs on the London Underground.