Two Hackers Sentenced to 5.5 Years for £29M TfL Breach

Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years in prison on Thursday, July 16, 2026, at Woolwich Crown Court. The sentencing follows their conviction for a significant cyberattack on Transport for London (TfL) that occurred in 2024. This breach resulted in 148 TfL systems becoming inoperable, causing widespread disruption to the transport authority's operations.

The attack necessitated a drastic security measure: all 27,000 TfL employees were required to reset their passwords in person at an office. This unprecedented step highlights the severity of the compromise. The National Crime Agency (NCA) and the Crown Prosecution Service (CPS) estimated TfL's losses and recovery costs to be approximately £29 million, underscoring the substantial financial impact of the hack.

Flowers and Jubair, identified as members of the hacking group 'Scattered Spider,' were implicated in the attack. The group is known for its sophisticated phishing and social engineering tactics, often targeting large organizations. The investigation and subsequent prosecution were led by the NCA, with support from the CPS, in bringing the perpetrators to justice. The sentencing serves as a stark warning regarding the consequences of large-scale cybercrime targeting critical infrastructure.