Two Young Hackers Sentenced for Major Cyberattack on London Transport
A UK court has sentenced two young men, Thalha Jubair, 20, and Owen Flowers, 18, to five-and-a-half years in prison for their involvement in a significant cyberattack on Transport for London (TfL) in September 2024. The attack exposed the personal details of around seven million customers, marking one of the largest data breaches in the UK. The pair pleaded guilty to hacking TfL's network, which resulted in substantial operational disruption and financial losses estimated at £29 million. Judge Mark Turner noted that their actions were driven by "selfish bravado" and caused serious disruption, although the attack did not affect transport services directly.
The cyberattack, which took place between August 31 and September 3, 2024, led to TfL having to reset passwords for approximately 27,000 employees and incurred costs of around £25 million due to the downtime. Prosecutors highlighted that the hackers had gained significant control over the network, stating they could have potentially shut down TfL completely, leading to catastrophic consequences. Both Jubair and Flowers were associated with Scattered Spider, a criminal collective linked to various high-profile cyberattacks, including those targeting major retailers.
The investigation, led by the National Crime Agency (NCA), revealed that Flowers had also hacked into US-based organizations, while Jubair had a history of cyber offenses dating back to his childhood. The court learned that the hackers accessed the TfL network using stolen employee credentials found on a dark web marketplace. They worked continuously for 16 hours, communicating via messaging apps to breach the system after convincing a helpdesk employee to reset a password.
During their intrusion, they searched for sensitive information, including the travel histories of celebrities and attempted to access payment details of customers. The NCA's cybercrime chief remarked that this case represents the largest criminal prosecution of cyber offenders in UK history, emphasizing the disruption caused by Scattered Spider's activities. The court also noted that while under custody, Flowers attempted to hack into international government domains, highlighting the ongoing threat posed by these individuals. Judge Turner remarked on Jubair's transition from being exploited as a minor to becoming a perpetrator, reflecting the complexities of youth involvement in cybercrime.
