Overview
- The court sentenced Thalha Jubair, 20, and Owen Flowers, 18, to five years and six months each on 16 July 2026 after both pleaded guilty in June to the Transport for London hack.
- Prosecutors said the pair breached TfL’s network between 31 August and 3 September 2024 and gained the highest administrative access that investigators described as ‘the keys to the kingdom’.
- Investigators found the attackers used credentials bought on criminal marketplaces and social engineering to trick a helpdesk into resetting two‑factor authentication and then escalated privileges inside TfL systems.
- The breach exposed roughly seven million customers’ names and contacts, forced about 27,000 staff to reset passwords in person, disrupted customer services and cost TfL about £29 million with a further c.£10 million claimed in lost income.
- Authorities linked the defendants to the Scattered Spider collective, said Flowers was also targeting US healthcare firms when arrested, and said the case has significantly disrupted the group while related international investigations continue.