Key facts
- Two men, Thalha Jubair and Owen Flowers, were sentenced to five-and-a-half years in prison each.
- They pleaded guilty to hacking Transport for London's (TfL) network in August-September 2024.
- The attack exposed the personal data of approximately seven million customers.
- The cyberattack cost TfL an estimated £29 million in damages and £10 million in lost income.
- The pair were linked to the cybercrime group Scattered Spider.
- Flowers also admitted to hacking US healthcare providers Sutter Health and SSM Health Care Corporation.
Two young men have been sentenced to five-and-a-half years in prison each for a significant cyberattack on London's public transport operator, Transport for London (TfL), in 2024. The breach exposed the personal data of approximately seven million customers and resulted in substantial financial losses for TfL.
Thalha Jubair, 20, and Owen Flowers, 18, pleaded guilty to hacking TfL's network between August 31 and September 3, 2024, gaining access to customer names and contact details. The attack, motivated by what the judge described as "selfish bravado," did not disrupt transport services but left parts of TfL's systems offline for three months.
The hackers gained access by using stolen employee credentials found on a dark web marketplace and communicating via Telegram. During the intrusion, they searched for celebrities' travel histories and attempted to access payment information. Prosecutors noted the pair were "experienced and talented" hackers known to police for years and were linked to the cybercrime group Scattered Spider.
In addition to the TfL attack, Flowers admitted to hacking US healthcare providers Sutter Health and SSM Health Care Corporation. Jubair had prior convictions for cyberattacks targeting Nvidia and the City of London Police.