A court in the UK has sentenced two young British hackers to prison for a large-scale cyberattack on London’s public transport authority, Transport for London (TfL), in 2024. The cost of recovery from the incident reached £29 million.
Thalha Jubair, 20, from East London, and Owen Flowers, 18, from Walsall in the West Midlands, were each sentenced to 5 years and 6 months in prison. Both pleaded guilty to unauthorised acts against computer systems under Section 3ZA of the Computer Misuse Act.
The attack took place in late August to early September 2024. The hackers gained access to TfL’s network, causing serious disruptions to online services, payment systems, and passenger services. The incident affected approximately 10 million customers, with personal data compromised, including information from the Oyster refund system.
TfL was forced to take some systems offline for several months to recover, causing significant inconvenience to residents and visitors of the capital. According to estimates, the recovery cost £29 million, including expenses for investigation, security enhancements, and compensation.
Both convicted individuals were members of the notorious international hacking group Scattered Spider. According to investigators, they were “experienced and talented” hackers despite their young age. Some media outlets reported that the attack was partially livestreamed.
Jubair and Flowers had already come to the attention of police for previous offences. The National Crime Agency (NCA) and City of London Police conducted the investigation, which became one of the largest cybercrime cases in British history.
NCA representatives emphasised the importance of the sentence as a warning to other cybercriminals. The judge highlighted the seriousness of the damage inflicted on London’s critical infrastructure.