Full Breakdown
Teen Hackers Sentenced for Disrupting London’s Transport Network
7/16/2026, 9:25:36 PM
The Attack and Sentencing
In August-September 2024, Owen Flowers (18) and Thalha Jubair (20) breached Transport for London’s (TfL) IT infrastructure, gaining “the highest privileged access” – described in court as “the keys to the kingdom.” Over a 16-hour livestreamed intrusion, the pair accessed the Oyster refund database, delayed contactless payments, and forced all 27,000 TfL employees to reset passwords in person. On 6 September 2024 they were arrested; on 5 July 2026 Woolwich Crown Court sentenced each to five years and six months’ imprisonment.
Background & Context
The hackers operated under the banner “Scattered Spider,” a loosely coordinated collective of English-speaking cyber-criminals linked to prior attacks on Marks & Spencer, the Co-op, and Jaguar Land Rover. The National Crime Agency (NCA) has identified the rise of young hackers like Flowers and Jubair as a major threat to UK cyber security.
Key Figures & Groups
- Owen Flowers – from Walsall, described by his counsel Adam Davis KC as an “immature child trying to show off online.” He was 17 at the time of the hack and later found with a laptop attempting to breach two US healthcare providers.
- Thalha Jubair – from a council flat in Bow, east London. His barrister Paul Keleher KC likened him to a “modern-day Oliver Twist,” noting a history of grooming into hacking from age four.
- Scattered Spider – the name assigned by cybersecurity researchers; members used Telegram to coordinate and to mock their own progress (“SCATTERED SPIDER IS CREATING WEBS ON THE UNDERGRND”).
- Transport for London (TfL) – the public-transport authority overseeing the Underground, buses, and ancillary services.
Data & Statistics
- Attack window: 31 August – 3 September 2024.
- Duration of livestreamed breach: 16 hours.
- Employees forced to reset passwords: ? 27,000.
- Personal data stolen: ? 7 million commuters.
- Direct financial impact: £29 million in IT-damage plus £10 million lost income (total £39 million).
- Prosecutors warned the hackers could have caused “catastrophic damage” and potentially jeopardised up to £56 billion of UK economic activity.
- Crypto holdings reported: Flowers ? $7.1 million; Jubair ? $10 million moved after a prior release.
Official Statements & Responses
Prosecutor Mark Fenhalls KC emphasized the duo’s “highly skilled” capability and “wholly indifferent” attitude toward public consequences. Judge Mr Justice Turner concluded their motives were “selfish bravado, heedless of the severe consequences to others.” TfL’s chief Andy Lord called the incident “the worst incident I have faced in my career.” The NCA noted the convictions “effectively halted the group’s criminal activity.”
Criticism & Opposition
Defense counsel argued the youths were products of “grooming” and “isolated, bullied” backgrounds. Paul Keleher KC portrayed Jubair as a victim of early exploitation, while Adam Davis KC highlighted Flowers’ “immature” desire for online recognition. Both barristers sought to contextualise the actions within broader social and psychological factors.
On-the-Ground Impact
TfL staff were required to attend physical offices for password resets, and the disabled-passenger dial-a-ride service was temporarily unable to process bookings. Although the main tube and bus services continued operating, the outage disrupted live arrival information on the TfL Go app and website.
Conflicting Reports & Gaps
Sources differ on the total cost: some cite £39 million (damage + lost income), others reference only £29 million, while prosecutors warned of a potential £56 billion loss. Additionally, the exact extent of service disruption beyond the Oyster and contactless systems remains unclear.
Verbatim Quotes
- “These two young men are highly skilled with computers and capable of wreaking havoc, and, you may think, wholly indifferent to the consequences for the public, and the potential suffering and costs to others.” — Mark Fenhalls KC
- “I’m satisfied that your actions were primarily motivated by selfish bravado, heedless of the consequences on others.” — Mr Justice Turner
- “u won’t be laughing when ur sat in prison.” — Owen Flowers (message to Jubair)
- “modern-day Oliver Twist” — Paul Keleher KC (describing Jubair)
What’s Next
The court ordered the pair to serve their sentences with a 15 percent reduction for guilty pleas. Both remain subject to ongoing investigations: Flowers is wanted in the United States for the attempted healthcare hacks, and the NCA continues monitoring Scattered Spider affiliates for further activity.
