Thalha Jubair, now 20, and Owen Flowers, 18, carried out the ‘extremely serious hack’ on TfL’s online network between August 31 and September 3, 2024 (Picture: PA)
Two teenagers who hacked into Transport for London’s computer systems could have cost the UK economy nearly £60 billion, a court has heard.
Thalha Jubair, 20, and Owen Flowers, 18, managed to get access to TfL’s networks after tricking helpdesk staff into resetting a password.
The pair, linked to a group known as Scattered Spider which was behind attacks on Marks and Spencer and the Co-op, then used the system to hack itself further, getting deeper into the networks.
Their hack was so successful that they obtained the highest privileged access, known as the keys to the kingdom.
Prosecutor Mark Fenhalls KC told Woolwich Crown Court this gave them ‘total control’, enabling them to put ransomware throughout the entire system.
Sign up for all of the latest stories
Start your day informed with Metro’s News Updates newsletter or get Breaking News alerts the moment it happens.
Facing catastrophic consequences, TfL pulled the plug on the entire system, resetting the passwords of all 27,000 staff. In the end, it cost TfL £29 million.
If they had encrypted or destroyed the central TfL system he said there could have been a ‘potential consequential loss of £56 billion to the UK economy’ through what TfL said would cause ‘significant and extended transport service degradation and disruption.’
TfL said: ‘Such widespread disruption would have had a serious impact on the travelling public, including for those accessing education, healthcare and other essential services, and London’s economy.’
Thalha Jubair , one of two young members of a criminal hacking group who carried out a cyber attack on Transport for London (TfL) (Picture: NCA/PA)
The pair carried out the hack between August 31 and September 3, 2024.
They worked through the night for 16 hours to access the network, with Flowers livestreaming the hack as Jubair carried it out.
Some of the videos were recovered when he was arrested three days later on September 6.
The pair were in constant contact throughout the attack and spoke about ‘nuking access’ to servers on their way out.
Mr Fenhalls said: ‘They were utterly reckless about the consequences of hacking TfL, the transport network and the communications for the country.
‘It only came to an end because TfL threw them out rather than they chose to stop.’
Owen Flowers was also linked to a group known as Scattered Spider (Picture: NCA/PA)
They used remote servers to conceal the origin of the attack, created virtual machines within the TfL system to destroy evidence, downloaded millions of lines of data from their systems and created multiple back doors.
Jubair’s barrister Paul Keleher KC described him as a ‘modern day Oliver Twist’ who had been groomed from a young age to use his skills for hacking.
But Mr Justice Turner dismissed the comparison, saying: ‘There’s no Fagin in this case; it’s a Faginless crime.
‘He has an audience but he doesn’t have a puppet master, he’s promoted himself to an instigator and perpetrator.’
Flowers’ barrister Adam Davis KC said he was an ‘immature child trying to show off online’. But when his laptop was seized following his arrest, it was in the process of hacking two US healthcare systems, SSM Health and Sutter Health.
Those hacks were only stopped because of the ‘fortuitous timing’ of his arrest, the court heard. He is wanted in the US but he is not beleived to be facing extradition proceedings.
After being placed on remand in September 2025, Flowers bought two ‘unlawful phones’ in prison and searched for logins to the Ministry of Justice, Wandsworth Prison staff, and the CPS.
Jubair, from east London, was sentenced last year for 22 offences including hacks on individuals, telecoms businesses and the City of London Police system.
Both men admitted conspiracy to commit unauthorised acts in relation to a computer causing or creating risk of serious damage.
Flowers, from Walsall, also admitted two counts of conspiracy to commit unauthorised acts in relation to a computer with intent to impair, in relation to the healthcare systems.
They will be sentenced tomorrow.
Get in touch with our news team by emailing us at webnews@metro.co.uk.
For more stories like this, check our news page.
Arrow
MORE: Covid cons said ‘let’s milk’ PPE shortages splashing cash on Rolexes and Porsches
Arrow
MORE: First picture of Sikh mum, 24, stabbed to death in what parents fear was ‘racist attack’
Arrow
MORE: Teen who helped murder stranger ‘for fun’ handed huge sentence
Comments
Add Metro as a Preferred Source on Google
Add as preferred source
Breaking News
Never miss the biggest stories with breaking news alerts in your inbox.