Two teenagers who orchestrated a significant cyber-attack on Transport for London (TfL) in 2024 have been sentenced to five years and six months in prison. Owen Flowers, 18, of Walsall, and Thalha Jubair, 20, of east London, pleaded guilty in June to charges related to the hack, which disabled TfL's online services for months, compromised the personal data of millions, and necessitated password resets for all 27,000 employees.
The cyber-attack, live-streamed by the perpetrators over 16 hours, was carried out when Flowers was 17 and Jubair was 18. According to the National Crime Agency (NCA), the rise of young hackers represents one of the most significant threats to national cybersecurity. Court proceedings revealed that the pair used Telegram to communicate, boasting about their access to TfL's Oyster card database and subsequently searching for personal details of London celebrities, while also attempting to access banking information.
Flowers and Jubair were described as computer-obsessed individuals operating as part of a cyber-crime collective known as Scattered Spider. The group has been linked to numerous other cyber-attacks targeting retailers such as Marks and Spencer and the Co-op. In recent years, young men and boys have been arrested in connection with Scattered Spider hacks across the UK, the United States, and Finland.