Two Hackers Sentenced for £29 Million Transport for London Cyberattack
Two hackers received 5.5-year sentences for a 2024 cyberattack on Transport for London that disrupted 148 systems and caused £29 million in damages, marking the first successful prosecution under Section 3ZA of the Computer Misuse Act. The attack, linked to the Scattered Spider group, also targeted US healthcare organizations and involved data extortion tactics, with authorities citing potential economic risks of up to £56 billion.
Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court on Thursday, 16 July 2026, for the 2024 hack of Transport for London.
The attack left 148 TfL systems inoperable and forced all 27,000 of the transport authority's employees into an office to get their passwords reset in person. Both the NCA and the CPS put TfL's losses and recovery
*** END OF TRANSMISSION ***