Two teenage hackers have admitted to a sophisticated cyberattack that crippled London's transport network and cost an estimated £39 million. Thalha Jubair, 19, and Owen Flowers, 18, members of the notorious online criminal group Scattered Spider, pleaded guilty to conspiracy to commit unauthorized acts in relation to a computer, causing or creating a significant risk of serious damage to human welfare.
The attack, which occurred between August 29 and September 3, 2024, disrupted key services for millions of travelers. The hackers targeted the Transport for London (TfL) Go app and website, preventing users from making payments to their Oyster cards and accessing real-time travel information. The prosecution described the incident as an 'unprecedented attack on critical national infrastructure.'
During the hack, Jubair and Flowers reportedly searched for and viewed personal details of various celebrities whose information was stored within the system, though they were unable to access credit card information. Prosecutor Mark Fenhalls, KC, noted the attack's scale and sophistication, highlighting the use of remote servers to conceal identities, the creation of virtual machines to destroy evidence, and the establishment of secure backdoors into TfL's core systems.
Flowers also admitted to hacking two U.S. healthcare companies, SSM Health Care Corporation and Sutter Health. During the attack on SSM, he sent a message indicating a potential to 'extort with db but locking is risky might kill some 90yr old on life support,' revealing a callous disregard for human welfare.
The hackers exploited a vulnerability by using 'social engineering' tactics to trick the TfL service desk into resetting authentication credentials. They cloned the domain controller, a critical system component, allowing them to harvest user passwords and sensitive data without triggering alarms. The pair worked continuously for a 16-hour period during the hack. The damage to TfL's infrastructure required six months of intensive remedial work, with the organization fearing the hack's potential to cause catastrophic damage to its technology systems.
In total, 148 technology systems became inoperable. The court heard that the hackers gained access to the 'Oyster Professional User System (OPUS)' and even obtained the credentials of TfL's Chief Information Security Officer, effectively having 'the Keys to the Kingdom.' The potential loss to the UK economy could have been as high as £56 billion had they managed to encrypt or destroy 'OneLondon,' a central TfL system to which they gained administrative rights.
Jubair and Flowers were arrested over a year after the hack, in September 2025. Investigators found Flowers actively hacking U.S. healthcare networks at the time of his arrest. National Crime Agency recovered videos on Flowers' computer, which captured Jubair livestreaming parts of the TfL hack, alongside real-time communications between the two on Telegram, detailing their coordination.
Forensic analysis linked Jubair to a 2022 credential leak, with evidence suggesting that stolen credentials from a TfL employee, obtained via 'RedLine Stealer' malware, were used in the 2024 breach. Jubair, who has a history of cyber-related offenses including fraud and unauthorized computer access, was already under a youth rehabilitation order at the time of the TfL attack. He has also been involved in previous high-profile hacks with groups like Lapsus$, targeting companies such as NVIDIA and Uber.
Flowers, who was previously issued a cease-and-desist notice for involvement in a 'swatting' hoax, possessed significant undeclared cryptocurrency holdings. Both defendants have been diagnosed with autism spectrum disorder. Jubair also suffers from depression and a severe mood disorder, while his defense attorney likened him to a '21st century Oliver Twist,' highlighting his early introduction to hacking due to social isolation and bullying.
Jubair is also wanted in the U.S. for charges carrying a maximum of 95 years in prison, related to alleged participation in at least 120 attacks on computer networks and extortion involving 47 U.S. companies. The Justice Department alleges victims paid at least $115 million in ransom payments in schemes involving social engineering, data theft, encryption, and money laundering.
The pair were remanded in custody ahead of their sentencing.