Key facts
- Teenage hackers Thalha Jubair and Owen Flowers gained privileged access to Transport for London's IT systems in August 2024.
- The cyberattack led to the theft of data from approximately 7 million commuters and cost TfL £39 million.
- Jubair was sentenced to five and a half years for the TfL hack.
- Flowers received a five and a half year sentence for the TfL hack and for compromising two US healthcare providers.
- Both hackers were identified as key members of the Scattered Spider hacking collective.
- The hackers accumulated millions of dollars in cryptocurrency through their illicit activities.
Teenage hackers Thalha Jubair and Owen Flowers have been sentenced to five and a half years in prison each for a significant cyberattack on Transport for London (TfL) and for compromising two US healthcare providers. The attack, which occurred between August 31 and September 3, 2024, gave the hackers "keys to the kingdom," allowing them "highest privileged access" to TfL's IT systems. Prosecutors stated that at one point, they "could have shut out and shut down TfL completely."
The breach resulted in the theft of data belonging to approximately 7 million commuters, forced 27,000 TfL staff to reset their passwords, and prevented the dial-a-ride service for disabled passengers from processing bookings for a period. The attack cost TfL £39 million, including £29 million in system damage and £10 million in lost income.
Jubair, 20, and Flowers, 19, were identified as key figures within the hacker group known as Scattered Spider. They communicated via Telegram during the multi-day crime, which Flowers livestreamed. Both defendants have been diagnosed with autism, and Jubair also has depression and a severe mood disorder. Flowers, who was 17 at the time of the hack, was described as an "immature child trying to show off online."
Despite no apparent lavish lifestyle, the hackers accumulated millions of dollars in cryptocurrency. Investigations revealed that $10 million was moved from Jubair's crypto wallets after his release from custody, and $200 million had moved through his accounts. Flowers reportedly held $7.1 million in accounts he controlled.
Paul Foster, head of the National Crime Agency's national cyber crime unit, stated that the convictions have severely degraded the Scattered Spider group's activities.