Britain’s biggest hack: Extraordinary story behind £29m TfL cyber attack carried out by crypto-millionaire teens from their bedrooms, who were eventually snared by a takeaway order…but are still hacking from jail

Two teenagers who became Britain’s biggest cyber hackers are facing prison for a £29 million attack on London’s transport network after being caught over a takeaway order.

Thalha Jubair and Owen Flowers disabled Transport for London (TfL) in a four-day cyberattack that threatened to cause £56bn of ‘catastrophic damage’.

Jubair even talked of ‘nuking’ access to the system, but TfL managed to ‘pull the plug’ on the network to stop the duo.

It can now be revealed how the pair became Britain’s worst hackers, extracting tens of millions of pounds in ransoms from companies around the world and continuing to wreak havoc even behind bars.

The prolific couple were members of the notorious Scattered Spider network, which has been linked to attacks that cost Jaguar Land Rover an estimated £1.9 billion, the £300 million M&S hack and attacks on Harrods and the Co-op that resulted in losses of £206 million.

Even while behind bars, 18-year-old Flowers used a smuggled phone to infiltrate the Crown Prosecution Service, the Ministry of Justice, various Government sites and even the prison where he was being held.

Meanwhile, Jubair, now 20, is estimated to have obtained £200 million worth of cryptocurrency from ransom companies since becoming a hacker at the age of 13, US prosecutors said.

18-year-old Owen Flowers used a smuggled phone to infiltrate the Crown Prosecution Service, the Ministry of Justice, various areas of the government and even the prison where he was being held.

After all, it was Jubair’s spending of money that proved his undoing, not on fast cars or jewellery, but on food parcels.

He bought gift vouchers for a food delivery service using a cryptocurrency wallet containing £27 million from which he and hackers allegedly received ransom payments from major US companies.

The mistake led the FBI to trace the packages straight to his door and discover that one of the most dangerous cyber hackers in Britain was a 17-year-old autistic loner who lived with his parents in a high-rise block next to the Met Police call processing center in Tower Hamlets, East London.

Yesterday Jubair’s ROK lawyer Paul Keleher told Woolwich Crown Court his client was a ‘modern day Oliver Twist’ who was groomed by criminals from the age of 13 to hack companies.

In a cautionary tale about ‘online upbringing’, Jubair was given a smartphone at the age of four and received his first laptop at the age of six from his father, a care worker, and his mother, who works with children with special needs.

By the age of nine, Jubair was writing computer programs. He graduated to hacking at the age of 13 after being recruited by gaming platforms such as Roblox. By the age of 15, he had managed to infiltrate the City of London Police systems.

Mr Keleher said his client later became the ‘Artful Dodger’ by recruiting other young hackers and teaching them tricks.

He enjoyed a growing reputation online after being bullied and isolated at school.

His bedroom in a 22-story skyscraper became the unlikely headquarters of a millionaire cybercriminal while Jubair was still in school.

Jubair promises to ‘fuck the railways’ and ‘nuk’ in September 2024[e] ‘Access’ after hijacking a single employee’s account to infiltrate Transport for London’s systems

It started with SIM swapping, where a person’s mobile phone number is forwarded to a hacker, allowing authentication codes to be sent directly to criminals.

Jubair recruited 700 victims using this method in the attack on BT/EE in 2021.

By the age of 15 he was part of a teenage hacking group described by prosecutors as ‘online thugs’; He claimed that his victims included technology giants such as Microsoft, Nvidia, Samsung, T-Mobile and Uber, and that he stole data and source codes, including Rockstar’s unreleased Grand Theft Auto 6.

Although he was under police investigation, Jubair was more worried about his parents finding out, according to messages sent to other hackers.

However, he was arrested while wearing his school uniform. In 2023, he was convicted of 22 crimes, including blackmail, fraud and harassment, and received an 18-month youth rehabilitation order.

However, Jubair continued to target large companies. US prosecutors linked him and his associates to the payment of ransoms of at least $115 million (£86 million); this includes a massive hack of Las Vegas casinos.

Court documents allege that Jubair even hacked the US federal court system by contacting the help desk, impersonating a judge to request a password reset, and then gaining access to the judge’s email account.

Jubair promises to ‘fuck the railways’ and ‘nuk’ in September 2024[e] Access’ after taking over a single employee’s account to hack Transport for London’s systems.

Although buses and tubes continued to operate, the breach disrupted TfL services for months, affected the personal data of millions of people and resulted in all 28,000 TfL employees having to reset their passwords themselves.

The booking system for Dial-a-Ride buses used by disabled people has been shut down and data on live tube times for apps such as TfL Go and Citymapper has been taken offline.

Jubair and Flowers went after famous TfL users but were unable to access their credit card details.

When police swooped in a few hours later, they caught Flowers hacking two US healthcare companies from his bedroom in Walsall, West Midlands, where he lived with his grandmother.

Even in his prison cell he continued to profit from his crimes, taking £450,000 in Bitcoin which he planned to ‘wash’ into clean cryptocurrency to pay off drug debts incurred from smoking cannabis behind bars.

Flowers boasted to other hackers that he would be released from prison soon: ‘Brother, I’m going to get about 2 years from TfL. I would do a trial year. Go home now. Currently on episode 3za [offence] i.e. maximum 14 years [in] ‘I was in prison but I can’t stay that long because I’m young.’

He added: ‘Brother, I have been studying law since I was arrested. I’m researching juries I can get.’

Perhaps they may find the judge less sympathetic as the pair are sentenced at Woolwich Crown Court today.

As Mr Justice Turner stated: ‘There is no Fagin in this case, this is a crime without Fagin.’