TEEN HACKERS SENTENCED FOR £39M TRANSPORT FOR LONDON CYBER ATTACK

Thalha Jubair and Owen Flowers are facing jail sentences following a cyber attack on Transport for London in 2024 that caused £39 million in losses. The attack forced all 28,000 TfL employees to reset their passwords and disrupted Oyster card services, resulting in delayed refunds and closed photocard applications. Both defendants were members of the criminal hacking group Scattered Spider. They initially denied conspiring to commit unauthorised computer access but changed their pleas to guilty before trial proceedings were scheduled to begin in June.

Jubair, described as 20 years old in one account and 19 in another, and Flowers, 18, targeted celebrity data during the attack by searching for and browsing information on various famous individuals. Scattered Spider has been linked to other significant cyber attacks, including intrusions affecting Jaguar Land Rover and retailers including Marks and Spencer. Flowers additionally admitted to targeting United States healthcare organisations, specifically SSM Health Care Corporation and Sutter Health, during separate incidents.

The guilty pleas represent a conclusion to the Crown Prosecution Service's case against both defendants. The sentences are expected to be delivered as part of proceedings related to the TfL breach and the additional charges against Flowers concerning the American healthcare sector attacks. The case marks one of the most significant cyber attacks against British critical infrastructure in recent years.