Teenage hackers behind massive $40 million London Transport cyberattack sentenced to 5 years in prison

In the culmination of the largest cybercrime prosecution ever brought before British courts, two young hackers have been jailed for orchestrating a devastating 2024 attack on London’s public transport infrastructure. The multi-day digital raid compromised the personal records of seven million commuters, threw public travel apps into chaos, and ultimately cost the city an astronomical £39 million ($40 million) to remediate.

Editorial credit: Tupungato / Shutterstock

Thalha Jubair, 20, from East London, and Owen Flowers, 18, from the West Midlands, were each sentenced to five and a half years in prison at Woolwich Crown Court. The pair had previously pleaded guilty to offenses under the Computer Misuse Act. Authorities revealed that both individuals were central figures within "Scattered Spider," a notorious, English-speaking cybercriminal syndicate that has severely disrupted major corporate networks globally over the past few years.

Holding a Capital's Network Hostage

The breach began in late August 2024 when a co-conspirator subtly manipulated a Transport for London (TfL) IT help desk by impersonating an employee needing a password reset. Once inside, Jubair and Flowers worked up to 16 hours a day from their bedrooms, systematically escalating their network privileges. They eventually established a "domain administrator" account, effectively seizing what prosecutors described as the "keys to the kingdom".

With near-absolute control over the digital infrastructure, the teenagers could have shut down the entire capital's transit network completely. While physical trains and buses remained operational, the digital fallout was severe. The duo crippled TfL’s ability to process Oyster card payments, took passenger booking systems for disabled riders offline, and corrupted live arrival applications. The crisis grew so intense that engineers resorted to a desperate, extreme measure to break the hackers' grip: completely disconnecting the organization’s entire enterprise computer network from the internet.

A Cyber-Crime Tracking Trail

Despite attempting to mask their tracks through encrypted chats and cryptocurrency networks, the hackers left behind critical digital breadcrumbs. Investigators tracked Jubair down after he used a crypto wallet tied to a multi-million-dollar ransomware server to purchase a food delivery voucher sent directly to his family home. When police raided their properties, they uncovered a laptop containing a recorded livestream of the hack in progress.

The court heard that both defendants live isolated, online lives and struggle with severe neurodevelopmental conditions, including autism. However, sentencing judge Mark Turner dismissed the defense claims of harmless internet experimentation. He concluded that the teenagers were driven primarily by selfish bravado, entirely heedless of the real-world chaos they inflicted on millions of everyday citizens.