Two men jailed over live-streamed cyber-attack that crippled Transport for London
Owen Flowers and Thalha Jubair, teenagers at the time, streamed a 16-hour intrusion that exposed the data of as many as 10 million Oyster card holders.
By Source Reporters Newsdesk
Wed, 22 July 2026 · 2 min read
Two men who attacked Transport for London's systems as teenagers have each been sentenced to five years and six months in prison, at the end of a case the National Crime Agency has used to underline how young Britain's most damaging hackers now are.
Owen Flowers, 18, from Walsall, and Thalha Jubair, 20, from east London, pleaded guilty in June to carrying out the 2024 hack. Woolwich Crown Court heard they were computer-obsessed loners operating as part of Scattered Spider, the loosely coordinated collective of young English-speaking hackers linked to dozens of other intrusions, including at Marks & Spencer and the Co-op.
The attack disrupted TfL's online services for months, stole the personal data of millions of passengers and forced all 27,000 TfL employees to reset their passwords in person. The court heard the pair streamed the 16-hour operation online as it happened.
Flowers was 17 and Jubair 18 when they entered the capital's transport authority at 17:00 on 31 August, timing the start for a Saturday night to reduce the chance of being noticed by staff. Access was obtained not through any technical flaw but through a phone call: they persuaded a help desk worker to reset the password of an employee they were impersonating.
Telegram messages between the two showed them boasting about reaching TfL's database of Oyster card holders, then searching it for the personal details of London celebrities before attempting to reach banking information. "Scattered Spider is creating webs on the London Underground," Flowers wrote at one point.
The consequences did not end with the sentencing. As the BBC has reported, the stolen database — containing the details of as many as 10 million TfL customers — is still being traded within criminal groups.
The NCA has described the rise of young hackers in the UK as one of the biggest threats to national cyber security. Over the past two years, young men and boys have been arrested over Scattered Spider intrusions in the UK, the US, Spain and Finland — a pattern that suggests the group's structure survives the removal of any individual member.