Overview
- Judge Mark Turner sentenced Thalha Jubair and Owen Flowers to five years and six months each on Thursday for a multi‑day intrusion into Transport for London’s systems in late August and early September 2024.
- Investigators found the pair used stolen logins bought on criminal marketplaces and social engineering to force a two‑factor authentication reset and escalate admin rights inside TfL’s Azure environment.
- The breach forced more than 27,000 TfL staff to reset passwords in person, disrupted online services such as Oyster refunds and Dial‑a‑Ride, and led authorities to estimate roughly £29 million in recovery costs plus about £10 million in lost income.
- Prosecutors presented videos and device evidence showing parts of the attack were livestreamed, and Flowers admitted separate attempts to hack US healthcare firms which raise possible extradition and US charges.
- Authorities say the case shows how small technical footholds and online notoriety can scale into major harm, highlights growing youth involvement in organised cybercrime, and underlines the need for international law‑enforcement cooperation and stronger frontline helpdesk safeguards.