Young cybercriminals facing jail over TfL hack that cost millions

Two young members of a criminal hacking group who carried out a cyber attack on Transport for London (TfL) that cost the organisation millions of pounds are facing jail.

Thalha Jubair, 20, and Owen Flowers, 18, hacked TfL’s online network, resulting in a £39 million loss, prosecutors previously said.

The hack also meant all of TfL’s around 28,000 employees were forced to attend an office to reset their passwords, the National Crime Agency (NCA) said.

Jubair and Flowers could be jailed when they are sentenced at Woolwich Crown Court in a hearing beginning on Wednesday.

Data from the Oyster refund system was accessed, refunds for some customers were delayed and applications for Oyster photocards for children and young people were closed down.

The defendants were members of Scattered Spider, the NCA said, which has been linked to other cyber attacks on Jaguar Land Rover and retailers including Marks and Spencer.

They had denied conspiring together to commit unauthorised acts, in breach of the Computer Misuse Act, between August 29 and September 6 2024 but changed their pleas to guilty before their trial was due to begin in June.

Flowers, of Walsall, West Midlands, who was first arrested over the TfL attack in September 2024 and then arrested again in September last year, also admitted targeting US healthcare firms.

He pleaded guilty to conspiring with others to commit unauthorised acts against SSM Health Care Corporation and attempting to commit unauthorised acts against Sutter Health.

Investigators found a range of electronic devices at Flowers’ home, including laptops, computers, hard drives and USB sticks, the NCA said.

They found one laptop included a screenshot showing connectivity to TfL’s infrastructure while evidence he accessed an online tool selling exposed user login details was also discovered.

Officers also found videos recorded by Flowers that showed Jubair accessing TfL systems during the attack, the NCA said.

The investigation found the pair were messaging through Telegram and collaborating via a shared online workspace.

Jubair, from Tower Hamlets, east London, faced an additional charge under the Regulation of Investigatory Powers Act of failing to disclose the Pin or passwords of his devices, which he denied, but that was left to lie on the file.

He and Flowers will be sentenced by Mr Justice Turner in a hearing due to begin at 10am on Wednesday, which is listed for two days.