Overview
- Thalha Jubair and Owen Flowers were each jailed for five years and six months at Woolwich Crown Court after sentencing on Thursday, July 16, 2026.
- The pair carried out a multi-day intrusion into Transport for London’s network between 31 August and 3 September 2024 that exposed roughly seven million customers’ names and contacts and disrupted many customer services.
- Prosecutors told the court the attackers used credentials bought on criminal marketplaces and social‑engineering to trick a helpdesk into resetting two‑factor authentication, then escalated to the system’s highest privileges described as the ‘keys to the kingdom.’
- TfL and investigators put direct loss and recovery costs at about £29 million with an additional £10 million claimed in lost income and warned that encrypting or destroying central systems could have caused economic damage measured in the tens of billions.
- The National Crime Agency said the prosecution has significantly degraded the Scattered Spider threat, international enquiries into related offences continue, and the case highlights concerns about recruitment and grooming of technically skilled young people into cybercriminal networks.