Teen hackers behind TfL cyber attack jailed for five years and six months

Two cyber attackers who targeted and disrupted Transport for London while they were teenagers have each been handed a five-year-and-six-month prison sentence.

In September 2024, TfL suffered a major cyberattack that disrupted services such as Dial-a-Ride and temporarily suspended some online services, including Live Tube arrivals and Oyster photocard applications. Core transport services remained operational, but attackers accessed customers’ personal data, including names, contact details, and, for around 5,000 customers, bank account numbers and sort codes used for Oyster card refunds. TfL responded with support from the NCA and NCSC.

The NCA arrested two teenagers, Thalha Jubair from East London and Owen Flowers from Walsall,  in connection with the cyber attack. They were charged under the Computer Misuse Act and linked to a cybercriminal group. The investigation involved cooperation between the NCA, NCSC, and international partners.

Flowers was initially released on bail after NCA questioning but was later charged over alleged attacks on U.S. healthcare firms, including SSM Health and Sutter Health, following new evidence. Jubair was charged under the Regulation of Investigatory Powers Act for allegedly refusing to provide PINs or passwords for seized devices. Both remained in custody and were due to appear at Southwark Crown Court on 16 October 2025. The NCA added that the TfL cyber attack was carried out by members of Scattered Spider, with both men suspected of being linked to the group.

In November, both defendants appeared at Southwark Crown Court and pleaded not guilty to charges of conspiring to carry out unauthorised acts against Transport for London (TfL). Appearing before the court, they spoke only to confirm their identities and enter their pleas. Judge Christopher Hehir scheduled the trial for 8 June 2026 with proceedings expected to run for four to six weeks. Both men remain held on remand.

Recently, Woolwich Crown Court sentenced the two cyber criminals to five years and six months’ imprisonment each for carrying out the cyberattack against Transport for London. The sentence was delivered by Mr Justice Mark Turner, who emphasised the significant impact of the attack on one of the UK’s largest public transport networks.

During the hearing, Justice Turner described the cyber attack as a highly sophisticated and carefully planned offence. He noted that, despite the defendants being young at the time of the attack, they understood the illegal nature of their actions and the risks involved in obtaining unauthorised access to critical systems. The judge stated that their actions appeared to have been motivated by “selfish bravado” and criticised their disregard for the disruption caused to TfL, its services, and the wider public.