Two Young Men Sentenced for Transport for London Cyber-Attack: A Case of Self-Serving Bravado
Recently, two young men have received sentences totaling five years and six months each for their involvement in a significant cyber-attack against Transport for London (TfL). The presiding judge highlighted that their motivations were not solely financial but also stemmed from a sense of “selfish bravado.” This case has garnered attention not only for its legal implications but also for the broader implications it has on cybersecurity and the growing threat landscape faced by organizations across the UK.
Owen Flowers, then 18, and Thalha Jubair, aged 20, were charged with committing unauthorized acts against TfL, in violation of the UK’s Computer Misuse Act (CMA). Their guilty pleas, presented in court on June 22, 2026, marked a pivotal moment as it represented only the second prosecution of its kind under the CMA in the UK.
The sentencing was delivered by Judge Justice Turner at Woolwich Crown Court in London on July 16. In reaching his decision, the judge took into account several factors. While mitigating circumstances such as the defendants’ youth and diagnosed neurodiversity were considered, the court could not overlook aggravating factors. Their high level of expertise indicated that they likely understood the severe consequences of their actions, which added weight to the decision.
Both individuals are suspected to have connections with a cybercriminal group known as Scattered Spider. This group has been implicated in high-profile cyber-attacks over the past few years, including incidents affecting Marks & Spencer and the Co-op, which took place in 2025. Scattered Spider operates alongside other notorious cyber organizations, including Lapsus$ and ShinyHunters, all of which originated from a loose collective referred to as The Com.
According to the National Crime Agency (NCA), groups affiliated with The Com typically utilize various tactics to access their targets. These methods range from phishing schemes to voice phishing (vishing) and SIM swapping. In addition to these techniques, ransomware strains have also been part of their arsenal, showcasing a diverse approach to cybercrime that poses a continual threat to organizations.
Significant Financial and Operational Fallout from the TfL Cyber-Attack
The NCA has reported that the cyber-attack on TfL resulted in immense financial repercussions, totaling approximately £29 million ($38 million) in loss and recovery costs. Furthermore, TfL has claimed an additional £10 million ($13.5 million) in lost income. While the immediate operational capacity of the TfL transport system was not directly affected, the repercussions were felt across various internal and customer-facing systems.
During the breach, sensitive data was accessed from TfL’s Oyster refund system, forcing the organization to suspend applications for Oyster photocards designed for children and young individuals. Additionally, the attack led to the closure of the booking system for Dial-a-Ride services, which assist people with disabilities. Live tube time data for mobile applications, including TfL Go and CityMapper, was also compromised, further affecting commuters.
In response to the incident, many TfL employees found themselves working from home throughout September 2024. In a further precautionary measure, over 27,000 employees were required to reset their passwords in person. The total number of individuals impacted by this cyber breach was estimated to be between seven and ten million across the UK, highlighting the extensive reach of the attack.
Had the cyber-attack succeeded in paralyzing the transportation network, estimates suggest that the financial toll to the UK economy could have soared to £56 billion ($75 billion), emphasizing the potential for widespread disruption that was fortunately averted.
How the Attack Was Executed: Social Engineering Tactics and Persistence
The cyber-attack commenced when Flowers, who was 17 at the time, and Jubair, then 18, gained unauthorized access to TfL’s systems on August 31, 2024. The duo managed to maintain their access until September 3, 2024. A senior officer from the NCA provided insights into their methods, noting that the two employed partial user credentials from TfL employees, which they sourced from infamous online criminal forums and marketplaces. Social engineering techniques were pivotal in securing access, particularly their ability to request a reset of the two-factor authentication (2FA) necessary for system entry.
The NCA officer remarked on the persistence displayed by the two young men as multiple attempts were made to succeed in the 2FA reset. The continuity of their communication through platforms like Telegram illustrated their close collaboration during the attack, with discussions revealing access to TfL’s database concerning Oyster cardholders. Moreover, some of their activities were reportedly streamed live to an audience, reflecting an alarming trend among cybercriminals seeking notoriety for their exploits.
Before their involvement with TfL, Flowers had previously encountered law enforcement and had received a cease and desist notice from the West Midlands Police in October 2023. During that intervention, he was offered training and guidance on computer misuse laws, an opportunity he ultimately declined. Post-arrest, Flowers faced strict bail conditions, which he violated on two occasions, illustrating a disregard for legal boundaries.
Jubair’s criminal history was equally extensive. Prior to the TfL incident, he had been in contact with authorities for several years, culminating in a Youth Rehabilitation Order related to offences tied to the Lapsus$ group. His prior convictions, amounting to 22, dated back to his youth, starting at the age of 14. In addition to the UK’s legal actions, he is also wanted by US authorities in connection with cybercrimes involving significant financial theft and extortion.
Conclusion: A Landmark Cybercrime Prosecution
Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, remarked that this case represents the largest cybercrime prosecution conducted in the UK, encapsulating nearly two years of collaborative investigative efforts involving the NCA, Crown Prosecution Service, and various policing partners. He emphasized that Scattered Spider has been one of the most significant cybercrime threats in recent years, and through this investigation, substantial strides have been made in disrupting their operations and holding key offenders accountable.
The NCA continues to stress that the threat posed by serious and organized cybercrime remains substantial, warning that while some attacks may be driven by a desire for notoriety from UK-based criminals, the majority originate from individuals in different jurisdictions seeking financial gain. This emphasizes the ongoing need for robust cybersecurity measures to protect against an evolving and increasingly sophisticated landscape of cyber threats.