A UK court on Thursday sentenced two young men to five-and-a-half years in prison each for their roles in a 2024 cyberattack against Transport for London (TfL). The incident, which stood as one of Britain’s largest data breaches, resulted in the exposure of personal contact details and names for approximately seven million customers.
Thalha Jubair, 20, of east London, and 18-year-old Owen Flowers, from the West Midlands, appeared at Woolwich Crown Court to receive their sentences. The pair had pleaded guilty last month to hacking the TfL network between 31 August and 3 September 2024. According to prosecutor Mark Fenhalls, the duo gained entry to the system by utilizing employee credentials sourced from "russianmarket," a dark web site. They allegedly spent 16 consecutive hours communicating via Telegram to breach the network after successfully tricking a helpdesk into resetting an employee's password.
Judge Mark Turner noted that while the attack did not disrupt actual transport services, it forced parts of the organization's systems offline for three months. The disruption resulted in costs of approximately £25 million, or €29.3 million. The judge characterized the motivation behind the crime as "selfish bravado" and described the impact as "very serious." During the breach, the hackers reportedly searched for celebrity travel histories and attempted to access payment information. Fenhalls stated that after obtaining additional privileges over several days, the pair held "the keys to the kingdom," effectively gaining control over the entire network.
The City of London Police confirmed the sentencing on X, noting the attack impacted thousands of customers and resulted in significant financial losses. The court heard that during the intrusion, Flowers remarked that "the government deserves to be hacked." Both men have been linked to the cybercrime group Scattered Spider, which is associated with high-profile attacks on companies like Marks & Spencer and the Co-op.
Following an investigation by the National Crime Agency (NCA), the two were arrested in September 2025. Prosecutors described them as "experienced and talented" individuals known to police for years. Flowers also admitted to separate hacks targeting US-based Sutter Health and SSM Health Care Corporation, discovered during his arrest on 6 September 2024. Jubair had previously received a conviction as a juvenile for targeting the chipmaker Nvidia and also admitted to hacking the City of London Police.
