Back to today’s briefing

Story perspectives

Two Hackers Plead Guilty in £29M TfL Attack

6/24/2026

49 9 Full Breakdown

Summary

Jubair, Flowers Guilty

Thalha Jubair and Owen Flowers pleaded guilty on 22 June 2026 to a Transport for London cyberattack; sentencing on 16 July 2026.
The breach accessed TfL’s network from 31 August to 3 September 2024, costing £29 million, forcing 28,000 to reset passwords and delaying Oyster refunds.
Investigators seized an Acer laptop with TfL connectivity, linked the pair to Telegram, and re-arrested on 16 September 2024 after Flowers’ 6 September 2024 arrest.

Summary

Flowers, Sentencing

Both offenders will remain in custody pending a two-day sentencing hearing on 15 and 16 July 2026.
Flowers breached bail twice in 2025 and kept selling stolen login credentials online.
The duo infiltrated U.S. hospital networks, compromising data at SSM Health Care and Sutter Health.
Investigators found the hackers accessed personal details and bank information of about 10 million TfL customers.

1 of 2

Jubair, Flowers Guilty

Thalha Jubair and Owen Flowers pleaded guilty on 22 June 2026 to a Transport for London cyberattack; sentencing on 16 July 2026.
The breach accessed TfL’s network from 31 August to 3 September 2024, costing £29 million, forcing 28,000 to reset passwords and delaying Oyster refunds.
Investigators seized an Acer laptop with TfL connectivity, linked the pair to Telegram, and re-arrested on 16 September 2024 after Flowers’ 6 September 2024 arrest.

1 / 2