UK hackers jailed for London transport cyberattack
Two British hackers behind a 2024 cyberattack on London’s public transport system that cost tens of millions of dollars to fix have been sentenced to more than five years in prison each.
Thalha Jubair, 20, and Owen Flowers, 18, pleaded guilty to hacking Transport for London (TfL), accused of hacking the “Scattered Spider” collective in June.
After gaining access to TfL systems, Jubair and Flowers hacked TfL, working up to 16 hours a day between 31 August and 3 September 2024 (Jubair from his parents’ flat in east London, Flowers from his grandmother’s house in central England).
Prosecutor Mark Fenhalls said Jubair live-streamed the hack, which Flowers watched, and the video found on Flowers’ laptop provided key evidence.
Fenhalls said on Thursday that the pair could “shut down TfL completely” and that the attack could only be stopped if TfL unplugged its computer systems.
The damage took six months and cost Stg 29 million ($A million) to repair.
Flowers also admitted to conspiring with others to hack two not-for-profit healthcare systems in the US just days after targeting TfL, attacks that were stopped “only because he was arrested and literally caught red-handed,” Fenhalls said.
Fenhalls said Flowers continued his hacking attempts from prison after his arrest, using devices that displayed search terms to access areas linked to the Crown Prosecution Service and the prison where he was being held.
Sentencing both Jubair and Flowers to five-and-a-half years in prison, Judge Mark Turner said he accepted they were “fundamentally motivated by selfish bravado”.
British authorities have previously said a hacking community known as Scattered Spider was responsible for the attack on TfL, and multiple reports have also linked the group to an attack on retailer Marks & Spencer.
Jubair and Flowers were aged 18 and 17 when they targeted TfL, but Fenhalls said they were already experienced hackers.
Jubair was convicted of hacking and blackmailing chip maker Nvidia in 2023 as part of the Lapsus$ hacking group, and was also convicted of stalking two young women, “shaking” one of them by trying to send armed police to her home.
