Teens jailed for five years and six months for livestreaming 16-hour TfL cyberattack

Two men who livestreamed their 16-hour cyberattack on Transport for London (TfL) on August 31, 2024, have been sentenced to five years and six months in prison.

Walsall resident Owen Flower, 18, and East London resident Thalha Jubair, 20, pleaded guilty last month to the cyberattack which crippled the TfL’s online services, stole personal data of millions of people and forced all employees of the transport service to change their passwords.

Woolwich Crown Court heard the case of “ computer-obsessed loners” who were both teens at the time of the attack. They gained access to TfL’s database of people with Oyster cards, searched personal details of London celebrities and attempted to access banking details of TfL customers.

According to the BBC, Flower and Jubair were both part of a larger hacking group, known as Scattered Spider, spread through the UK, US and Finland.

The group was linked to several other attacks, including on retailers Marks and Spencers and the Co-op.

How did they get access to TfL network:

Jubair and Flower, both autistic teens, impersonated an employee and tricked a phone help desk worker to change the password of the employee they were impersonating.

They gained access to data of 10 million TfL customers, which according to some reports is still being shared in criminal groups.

The cyberattack is estimated to have cost TfL around £29 million.