Young cybercriminals facing jail over TfL hack that cost millions
Two teenage members of the criminal hacking group who carried out a cyber attack on Transport for London (TfL) costing the organization millions of pounds are facing prison.
Prosecutors previously said Thalha Jubair, 20, and Owen Flowers, 18, hacked TfL’s online network, causing £39 million in losses.
The National Crime Agency (NCA) said the hack also meant around 28,000 of TfL’s staff were forced to travel to an office to reset their passwords.
Jubair and Flowers could face prison sentences at a hearing at Woolwich Crown Court that begins on Wednesday.
Data in the Oyster refund system was accessed, some customers’ refunds were postponed, and Oyster photo card applications for children and young people were closed.
The NCA said the defendants were members of Scattered Spider, which has been linked to other cyber attacks on Jaguar Land Rover and retailers including Marks and Spencer.
They denied conspiring together to commit unauthorized acts in violation of the Computer Misuse Act between August 29 and September 6, 2024, but changed their pleas to guilty as their trial was due to begin in June.
Flowers, from Walsall, West Midlands, who was first arrested for the TfL attack in September 2024 and then arrested again in September last year, also admitted targeting US healthcare firms.
He pleaded guilty to conspiring with others to commit unauthorized acts against SSM Health Care Corporation and attempting to commit unauthorized acts against Sutter Health.
The NCA said investigators found a number of electronic devices at Flowers’ home, including laptops, computers, hard drives and USB sticks.
A screenshot was found on a laptop showing a connection to TfL’s infrastructure, while evidence of access to an online tool selling exposed user login details was also discovered.
The NCA said officers also found videos recorded by Flowers showing Jubair accessing TfL systems during the attack.
The investigation revealed that the two were messaging via Telegram and collaborating through a shared online workspace.
Jubair, of Tower Hamlets, east London, faced an additional charge under the Investigative Powers Regulations for failing to disclose the Pin or passwords for his devices; He himself denied this, but it remained in the file.
He and Flowers will be sentenced by Mr Justice Turner at a hearing scheduled to last two days, starting at 10am on Wednesday.
