Two Hackers Sentenced to 5.5 Years for 2024 Transport for London Cyberattack
6 verified4 unconfirmed2 contested
Two hackers were sentenced to five years and six months in prison on Thursday for a 2024 cyberattack against Transport for London (TfL), the agency that runs London’s public transit system. Thalha Jubair, 20, and Owen Flowers, 18 or 19, pleaded guilty earlier this year to hacking into TfL’s IT systems over four days in late August and early September 2024. The attack disrupted the agency’s ticketing system, live train arrival information, and the TfL Go app, and forced 27,000 TfL staff to reset their passwords. Authorities said the two hackers gained such deep access that they could have shut down TfL completely and held the “keys to the kingdom” to the company’s systems. Both were members of the cybercrime group Scattered Spider, which British authorities called the most significant cybercrime threat to the U.K. in recent years. The National Crime Agency stated that the convictions have severely disrupted the group’s criminal activity.
What’s verified
Thalha Jubair and Owen Flowers were each sentenced to five years and six months in prison for hacking Transport for London in 2024.
The attack occurred between 31 August and 3 September 2024.
The hackers gained “highest privileged access” to TfL’s systems, described as “the keys to the kingdom.”
The attack disrupted TfL’s ticketing system, live train arrival information on the TfL Go app and website, and the dial-a-ride service for disabled passengers.
Both hackers were members of the cybercrime group Scattered Spider.
The National Crime Agency said the convictions have “severely disrupted” Scattered Spider.
Where accounts differ
The age of Owen Flowers: One source reports he was 19 at sentencing, while another reports he was 18.
The total financial cost of the attack: One source reports a total of £39 million (£29 million in IT damage plus £10 million in lost income), while another reports losses of around £29 million.
Not yet confirmed
One source reports that the two hackers communicated via Telegram and that Flowers recorded a livestream of the attack, which Jubair broadcast.
The same source reports that Jubair had 22 previous convictions as a teenager, that both defendants have been diagnosed with autism, and that the attack cost TfL £39 million.
Another source reports that the FBI accused Jubair of being involved in attacks on more than 120 companies using social engineering.
It is not specified by any source whether the data of approximately 5,000 or 7,000 customers was stolen – only one source mentions 7 million people’s data being stolen.
Key figures
Thalha Jubair (20-year-old hacker)
Owen Flowers (18- or 19-year-old hacker)
Andy Lord (head of Transport for London)
Paul Foster (head of the National Crime Agency’s National Cyber Crime Unit)
Mr Justice Turner (sentencing judge)
Adam Davis KC (defense lawyer for Flowers)
Sources: The Guardian, TechCrunch
