- Owen Flowers, 18, and Thalha Jubair, 20, were sentenced to five years and six months in prison each for their roles in the cyber attack on Transport for London (TfL) that occurred in August-September 2024.
- The attack, which was livestreamed, caused £29 million ($39 million) in damages and disrupted TfL's online services for months.
- The Woolwich Crown Court judge noted the sophistication of the attack and the significant planning behind it, despite the defendants' immaturity.
- Flowers and Jubair were part of the Scattered Spider group, described as presenting the most significant cyber threat to the UK.
- The pair gained access to TfL's network by impersonating an employee and tricking a helpdesk worker into resetting their password.
- The attack on TfL began on August 31, 2024, and lasted until September 3, 2024, during which the hackers streamed their activities online for 16 hours.
- The incident forced TfL to pull the plug on its systems, leading to significant operational disruptions and financial losses.
- Both Flowers and Jubair have autism, and Jubair has additional mental health challenges, which were considered during sentencing.
- The attack resulted in 148 technology systems becoming inoperable, heavily disrupting services including Dial-a-ride for vulnerable Londoners.
Owen Flowers, 18, and Thalha Jubair, 20, members of the Scattered Spider hacking group, were sentenced to five and a half years in prison for a cyberattack on Transport for London (TfL) that caused £29 million in damages.12346
The attack, which occurred between August 31 and September 3, 2024, disrupted TfL's online services and forced all 27,000 employees to reset their passwords in person.8
The pair gained access to TfL's network by tricking a helpdesk worker into resetting their password, allowing them to livestream their 16-hour hack.
“This is the largest cybercrime prosecution ever brought before the UK courts,” said Paul Foster, Deputy Director of the National Crime Agency (NCA).
The attack impacted 148 technology systems, including critical services for disabled and vulnerable Londoners.11
“The attack on Transport for London caused significant financial harm and disruption to a vital part of the UK's critical infrastructure,” Foster added.
.jpeg?width)
Both Flowers and Jubair, who have autism, were described as computer-obsessed loners.10
Jubair has a history of 22 previous convictions related to hacking and is wanted in the US for cyber crimes against 47 victims, allegedly leading to $115 million in ransoms.
The judge noted the sophistication of the attack and the significant planning involved, stating, “I’m satisfied that your actions were primarily motivated by selfish bravado heedless of the consequences on others.”5
The sentencing marks only the second conviction under Section 3ZA of the Computer Misuse Act 1990, reserved for the most serious offenses.
The NCA claims the Scattered Spider group has been significantly disrupted by these arrests, but experts warn that it may not deter young hackers from similar crimes.
“The attack forced all 27,000 TfL employees to reset their passwords in person and disrupted services including Dial-a-Ride for disabled Londoners. The hackers had gained 'the keys to the kingdom' with highest privileged access, which the prosecution said could have allowed them to shut down TfL completely.”
London Evening Standard
The Independent
