Full Breakdown
London Transport Hackers Sentenced for Disrupting TfL
7/16/2026, 9:25:27 PM
The Attack and Sentencing
Owen Flowers, 18, of Walsall, and Thalha Jubair, 20, of Bow, east London, were each sentenced to five years and six months in prison at Woolwich Crown Court for a multi-day intrusion into Transport for London’s (TfL) IT network. The hack began at 17:00 GMT on 31 August 2024 and continued until 3 September 2024, during which the pair streamed a 16-hour assault live on Telegram. Judge Mr Justice Turner described the conduct as “primarily motivated by selfish bravado, heedless of the consequences on others.”
Background and the Scattered Spider Collective
Flowers and Jubair operated under the banner “Scattered Spider,” a loosely coordinated English-speaking hacking group linked to prior attacks on Marks & Spencer, the Co-op and Jaguar Land Rover. The National Crime Agency has warned that the rise of young hackers such as these represents a major threat to the United Kingdom’s cyber security.
Who Were the Hackers?
- Owen Flowers – 17 years old at the time of the intrusion, living with his grandmother and uncle in Walsall. He was previously known to West Midlands police, received a cease-and-desist notice in October 2023 and declined a training offer aimed at steering him away from cybercrime. He has been diagnosed with autism and described by his counsel as an “immature child trying to show off online.”
- Thalha Jubair – 18 years old during the attack, residing with his parents in a council flat in Bow. He has autism, depression and a severe mood disorder. Prior convictions include 22 offences such as fraud, unauthorised computer access and blackmail, as well as a youth-court finding of stalking two young women. His barrister likened him to a “modern-day Oliver Twist.”
Impact and Costs
The intrusion gave the duo “the keys to the kingdom” – the highest privileged access in TfL’s systems – after tricking a help-desk operator into resetting a password. They accessed the Oyster refund database, delayed contactless payments, halted applications for Oyster photo-cards, and disabled the dial-a-ride service for disabled passengers. Approximately seven million commuters’ personal data were stolen, and live tube arrival information was removed from the TfL Go app and website.
TfL reported a direct financial impact of £39 million (£29 million in IT damage plus £10 million in lost income). Prosecutors, however, warned that the attack could have caused “billions” of pounds in loss had the hackers locked or destroyed the central system, a figure that later appeared as a £56 billion potential loss in court statements.
Official Responses
- TfL’s chief executive, Andy Lord, called the incident the worst he had faced in his career.
- Prosecutor Mark Fenhalls KC warned the pair were “highly skilled … capable of wreaking havoc.”
- The National Crime Agency noted the case “effectively halted the group’s criminal activity.”
Criticism and Defense Perspectives
Defense counsel highlighted the defendants’ troubled backgrounds. Paul Keleher KC argued Jubair had been groomed from a young age, while Adam Davis KC portrayed Flowers as an isolated teenager seeking online validation.
Conflicting Reports & Gaps
- Financial impact: TfL cites £39 million, whereas prosecutors cited a possible £56 billion loss.
- Scope of damage: TfL said the main tube and bus networks remained operational, yet the court heard the hack could have “shut out and shut down TfL completely.”
Verbatim Quotes
- “These two young men are highly skilled with computers and capable of wreaking havoc and you may think wholly indifferent to the consequences for the public and the potential suffering and costs to others.” — Mark Fenhalls KC
- “I’m satisfied that your actions were primarily motivated by selfish bravado, heedless of the consequences on others.” — Mr Justice Turner
- “Scattered Spider is creating webs on the London Underground,” — Owen Flowers
- “immature child trying to show off online.” — Adam Davis KC
- “modern-day Oliver Twist” — Paul Keleher KC
