atisusanti
Two men, who were teenagers when they orchestrated a devastating cyber-attack on Transport For London (TfL) in 2024, have been sentenced to five years and six months in prison. Owen Flowers, 18, from Walsall, and Thalha Jubair, 20, from east London, both admitted their involvement in the hack, described by authorities as a brazen act carried out with a chilling disregard for the consequences. The duo, characterized as "computer-obsessed loners," were part of a loosely coordinated cyber-crime collective known as Scattered Spider, a group that has become a significant concern for national cybersecurity.
The ramifications of their 16-hour digital assault were far-reaching and severe. TfL’s online services were crippled for months, and crucially, the personal data of millions of individuals was compromised. The breach necessitated a drastic security measure: all 27,000 TfL employees were required to reset their passwords in person, a testament to the extent of the intrusion. Woolwich Crown Court heard that the criminals not only executed the attack but also live-streamed their illicit activities, apparently seeking notoriety within online criminal circles. The National Crime Agency (NCA) has identified the surge in young hackers operating in the UK as one of the most pressing threats to the nation’s digital defenses.
At the time of the hack, Flowers was just 17, and Jubair was 18. Their intrusion into the capital’s transport authority commenced at 1700 on August 31, 2024. Evidence presented in court, including Telegram messages exchanged between the pair, revealed their boastful discussions about infiltrating TfL’s database, specifically targeting records of individuals with Oyster cards. The teenagers then embarked on a disturbing search through these lists, seeking the personal details of London celebrities, and even attempted to access banking information. Flowers’ chillingly prescient joke, "Scattered Spider is creating webs on the London Underground," underscored the group’s growing reach and ambition. Scattered Spider has been implicated in numerous other high-profile cyber-attacks, including those targeting major retailers like Marks and Spencer and the Co-op. The group’s international reach is also evident, with arrests of young individuals linked to Scattered Spider hacks occurring in the UK, US, Spain, and Finland over the past two years.
The TfL hack, a spree that began on a Saturday night to maximize their chances of evading immediate detection, resulted in the theft of data belonging to millions of customers. As previously revealed by the BBC, this compromised database continues to circulate within criminal networks, containing the sensitive details of up to 10 million TfL customers. Jubair and Flowers gained initial access by employing a social engineering tactic, tricking a phone help desk worker into resetting the password of an employee they were impersonating. Although TfL was alerted to the breach by the NCA and acted swiftly to expel the intruders, the damage was already done, with millions of individuals’ personal information now in the hands of criminals. The transport authority stated that the hack could have precipitated widespread chaos had its IT team not intervened by logging out all staff and, in a decisive move, disconnecting TfL systems from the internet. The attack rendered 148 technology systems inoperable, severely disrupting essential services, including Dial-a-Ride, a vital lifeline for disabled and vulnerable Londoners. TfL estimates the financial fallout from the hack to be a staggering £29 million, with an additional £10 million lost in income.
The court was informed that both men led isolated lives, with few offline social connections, and spent the majority of their time unsupervised online. In his sentencing remarks, Judge Mr Justice Turner acknowledged their young age and diagnosed autism as mitigating factors. Police reports indicate that Flowers was largely housebound, dedicating his time to his computer. His prior involvement in minor cybercrime was noted, with a cease and desist order issued in October 2023, shortly after his 16th birthday. Despite this warning, the teenager, living with his grandmother and uncle, proceeded to commit further cyber offenses. His arrest in September 2024 in connection with the TfL attack was captured on video, showing him laughing as he was taken into custody. During the raid, investigators discovered Flowers actively engaged in hacking two US healthcare providers. Disturbingly, his intercepted messages revealed callous jokes about the potential to "kill a 90-year-old on life support" due to the disruptions his hacks could cause. He pleaded guilty to offenses related to these hacks, alongside the TfL cyber-attack. Authorities also seized cryptocurrency holdings valued at approximately £1 million. While Flowers and Jubair were believed to have amassed millions in stolen or ransomed cryptocurrency, law enforcement suggests their primary motivation was likely online notoriety rather than purely financial gain.
Jubair, much like Flowers, had been on the radar of law enforcement for several years. The court heard that he was introduced to his first laptop at the age of 10 by his parents, who had emigrated from Bangladesh. He rapidly developed his coding skills and, by 13, was engaging with criminals online. His first arrest occurred in February 2021, at the age of 14. In 2023, while still a minor, he received a Youth Rehabilitation Order for his involvement with the Lapsus$ cyber-crime group, which had targeted major corporations like Nvidia and BT. His identity was protected at the time due to his age. Jubair has a lengthy criminal record, with 22 previous convictions for offenses including hacking, fraud, and harassment. His defense team argued that the lonely and reportedly suicidal teenager had been effectively groomed by older, more experienced cyber criminals. He is also a person of interest in the US, facing charges related to cyber crimes against 47 US-based victims, which allegedly resulted in $115 million being paid in ransoms to Jubair and his associates. Jubair had achieved a significant profile within the English-speaking cyber-crime community, known as "The Com." However, a subsequent falling out led to his personal details and images being leaked online by rival hackers. Some of the leaked videos depict Jubair seemingly being held hostage and assaulted, though there is speculation that these incidents may have been staged by the financially successful criminal.
During their time in prison awaiting trial, both Jubair and Flowers were found to be in possession of contraband mobile phones. Recovered messages indicate that the men continued to discuss and plan future cyber-attacks, demonstrating a persistent disregard for the law. Following the sentencing, NCA Deputy Director Paul Foster, head of its National Cyber Crime Unit, emphasized the significant challenges posed by homegrown hackers. "The online world can expose young people to harmful influences and criminal communities far beyond their front door," he stated. "Parents, carers, educators, technology companies, and law enforcement – the whole of society – we all have a role to play in helping to keep young people safe online." Foster asserted that Scattered Spider had been "heavily degraded and disrupted" as a result of the arrests. However, cyber security analyst Allison Nixon suggested that this would do little to deter other young individuals from engaging in cybercrime. She urged policymakers to address the issue as a "violent youth gang problem, with a gang culture that idolizes the destruction of society and maximizing victim harm."
George Anjay
Ramos Leo
Nana Banana
Nakalama John