Two “talented” hackers who cost Transport for London £39million after carrying out a cyber attack on its systems have been jailed.
Thalha Jubair, 20, and Owen Flowers, 18, conducted an “extremely serious hack” on TfL’s online network which could have done “catastrophic damage”.
TfL was forced to “pull the plug” on its systems at huge costs after carrying out the hack between August 31 and September 3, 2024.
Data from the Oyster refund system was accessed, contactless systems were delayed, and applications for Oyster photocards for children and young people were closed down.
The hack also meant all of TfL’s more than 27,000 employees were forced to attend an office to reset their passwords.
Both men were jailed for five years and six months in prison when they were sentenced at Woolwich Crown Court on Thursday.
The two men, who were both teenagers when they carried out the attack, were part of the notorious Scattered Spider gang, which was also linked to last year's huge cyber attacks on M&S, Co-op and Jaguar Land Rover.
Both Jubair, from Bow in East London, and Flowers, from Walsall, West Midlands, pleaded guilty to the attack as they were about to face trial last month, having initially denied the charges.
Read more: Who are the young cybercriminals behind the £39million TfL hack?
The hackers worked through the night for 16 hours to access the TfL systems after tricking the helpdesk into resetting a password for them.
They then logged on to Microsoft Azure and began “using TfL’s own systems to hack itself” as they moved up through the system.
They even searched through TfL’s customer database for celebrities.
The prosecution said the hackers “could have shut out and shut down TfL completely” as they eventually had the “highest privileged access” in the system, known as “the keys to the kingdom”.
Along with the £29 million in damages from disruption to services and operational work, TfL claims the incident cost £10million in lost income.
Judge Mr Justice Turner, sentencing the defendants, said: “I’m satisfied that your actions were primarily motivated by selfish bravado heedless of the consequences on others.”
Mark Fenhalls KC, prosecuting, said: “These two young men are highly skilled with computers and capable of wreaking havoc and you may think wholly indifferent to the consequences for the public and the potential suffering and costs to others.”
Speaking to Flowers, the judge said: “You acted as part of a group of conspirators, your corporate victims providing a valuable public service with which you were seriously interfering.”
Defending Jubair, Paul Keleher KC compared his client to a “modern-day Oliver Twist” who had been groomed from a young age to use his skills for hacking.
Jubair was sentenced last year for 22 offences including hacks on individuals, telecoms businesses and the City of London Police system, the court heard.
On behalf of Flowers, who was 17 when he conducted the hack, Adam Davis KC described his client as an “immature child trying to show off online”.
When Flowers was arrested in September 2024, his laptop was found in the process of hacking two US healthcare systems.
Those hacks were only stopped because of the “fortuitous timing” of his arrest, the court heard.
Both young men admitted conspiracy to commit unauthorised acts in relation to a computer causing or creating risk of serious damage.
Flowers also admitted two counts of conspiracy to commit unauthorised acts in relation to a computer with intent to impair, in relation to the healthcare systems.
Flowers, wearing a blue top, and Jubair, wearing a grey suit with a striped tie, both spoke to confirm their identities and did not react as they were sentenced.
.png?w=600)
