UK jails two teenage hackers for massive London transport cyberattack

Two young hackers have been sentenced to five years and six months in prison for a 2024 cyberattack on Transport for London (TfL) that exposed the personal data of millions of customers and cost tens of millions of pounds Source: BBC. Thalha Jubair, 20, and Owen Flowers, 18, pleaded guilty in June to hacking TfL's network between August 31 and September 3, 2024 Source: The Guardian.

The breach

The pair gained access using stolen employee credentials from a dark web marketplace and spent 16 hours infiltrating TfL's systems, live-streaming their attack Source: Euronews. They created a 'domain admin' account, effectively holding 'the keys to the kingdom' and could have shut down TfL completely Source: The Guardian. The attack affected around 7 million customers, with names and contact details stolen, and forced 27,000 employees to reset passwords Source: SCMP, BBC.

Impact and response

The attack did not disrupt tube or bus services but knocked TfL's online systems offline for three months Source: Euronews. Costs were estimated at £29 million ($38.9 million) in damages and recovery Source: Cointelegraph. Judge Mark Turner said the actions caused 'very serious' disruption and were motivated by 'selfish bravado' Source: SCMP. The National Crime Agency (NCA) said the jailing has 'severely disrupted' the Scattered Spider group Source: TechCrunch.

Scattered Spider links

Both men were key members of the cybercrime collective Scattered Spider, linked to attacks on companies like MGM and Caesars Entertainment Source: TechCrunch. Flowers also admitted hacking US healthcare providers Source: Euronews. US prosecutors say the group collected $115 million in crypto ransoms from dozens of companies Source: Cointelegraph.