Teenage Hackers Jailed for Major London Transport Network Cyberattack

London, UK — Ekhbary News Agency

Two teenage hackers, Thalha Jubair and Owen Flowers, have been sentenced to five and a half years each for a major cyberattack that crippled parts of London's transport network in 2024. The duo's actions led to the theft of millions of commuter data records and forced 27,000 Transport for London (TfL) staff to reset their passwords, highlighting a significant vulnerability in critical public infrastructure.

Unprecedented Access and Disruption

Between August 31 and September 3, 2024, Jubair, 20, and Flowers, 19, burrowed deep into TfL's IT systems, gaining what prosecutors described as "the highest privileged access." They created a "domain admin" account, effectively holding the "keys to the kingdom," and, as it happens, could have completely shut down TfL. While the main Tube and bus services remained operational, the dial-a-ride service for disabled passengers suffered booking disruptions. Andy Lord, head of TfL, a British Airways veteran, called it the worst incident of his career, with TfL stating the attack could have caused "catastrophic damage" and "significant and extended transport service degradation."

Motivations and Consequences

Mr Justice Turner, presiding over the sentencing, noted the attack was "primarily motivated by selfish bravado, heedless of the severe consequences to others." The hackers, key figures in the "Scattered Spider" collective, even searched TfL's customer database for celebrities. Their criminal activities, which also included Flowers hacking two US healthcare providers, had amassed them millions in cryptocurrency. The National Crime Agency confirmed Thursday that these convictions have "effectively halted the group’s criminal activity," a testament to the global reach of cybercrime. The severity of the sentences underscores the critical importance of robust cybersecurity measures in public infrastructure.