Two British teenagers are facing jail for a cyberattack on Transport for London (TfL) that, according to prosecutors, threatened £56 billion in potential damage. The pair, identified as Thalha Jubair, 20, and Owen Flowers, 18, are alleged members of the Scattered Spider network, a group linked to numerous high-profile cybercrimes.
US prosecutors believe Jubair handled approximately £200 million in cryptocurrency from ransomed businesses since he began hacking at age 13. The investigation into Jubair's activities led authorities to discover he had allegedly bought gift vouchers for a food delivery service using a cryptocurrency wallet containing £27 million, which was part of ransom payments from major US companies. This purchase allowed the FBI to trace the funds and identify Jubair, then 17, living with his parents in London.
Jubair's lawyer described him as a 'modern day Oliver Twist,' groomed into hacking from a young age. He reportedly received his first smartphone at four and a laptop at six, and by age nine, he was writing computer programs. He was recruited into hacking on gaming platforms by age 13 and by 15 had infiltrated the City of London Police systems. He later graduated to leading other young hackers and was involved in attacks on tech giants including Microsoft, Nvidia, Samsung, T-Mobile, and Uber, as well as the theft of unreleased game data from Rockstar. In 2023, Jubair was convicted of 22 offenses, including blackmail, fraud, and stalking, receiving a youth rehabilitation order.
US prosecutors have linked Jubair and his associates to at least $115 million in ransom payments, including a significant hack of Las Vegas casinos. Court documents allege that Jubair also hacked the US federal court system by impersonating a judge to a help desk to gain access to a judge's email account.
In September 2024, Jubair reportedly vowed to disrupt railway systems and 'nuke access' after compromising a TfL employee's account. The four-day attack on TfL disrupted services for months, affected the personal data of millions, and required all 28,000 employees to reset their passwords. The booking system for Dial-a-Ride buses, used by individuals with disabilities, was shut down, and live Tube time data for various apps was taken offline. While the pair were unable to access credit card details of TfL users, they reportedly targeted celebrity users.
Flowers, 18, was apprehended by police while allegedly hacking two US healthcare companies from his bedroom. Even while incarcerated, Flowers reportedly continued his criminal activities, using a smuggled phone to attempt hacks on various government domains, including the Crown Prosecution Service and the Ministry of Justice. He also allegedly received £450,000 in Bitcoin while in prison, which he intended to use to pay drug debts.
The notorious Scattered Spider network has been implicated in other major cyber incidents, including an attack on Jaguar Land Rover estimated to have cost £1.9 billion, a £300 million hack of M&S, and attacks on Harrods and the Co-op resulting in losses of £206 million. The group is known for its involvement in SIM-swapping and ransomware attacks.