Pair jailed for hacking into Transport for London
Thalha Jubair and Owen Flowers hacked the TFL network in late August 2024.
Last updated 16th Jul 2026
Two men have been sentenced to five years and six months for mounting a cyber attack against Transport for London.
20-year-old Thalha Jubair, from East London, and Owen Flowers, 18, from the West Midlands compromised the TFL network between the 31st of August and 3rd of September 2024.
The hack cost TFL £29 million in loss and recovery costs, and forced all 28,000 employees to go through a password reset.
Data from TFL's Oyster refund system was accessed and closed down the application system for Oyster photocards for children and young people.
The pair were arrested shortly after the attack, and pleaded guilty on the 22nd of June 2026.
Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said:
“This has been a lengthy, highly complex and painstaking investigation.
“The perseverance and meticulousness of our officers, and the work of our partner organisations, meant that Jubair and Flowers had no option other than to plead guilty and take responsibility for their offending.
“Cyber crime may appear faceless and distant compared to other crime types, but the infiltration of TfL’s systems shows it has real-world consequences and impacts hugely on the public.
“The attack caused millions of pounds in losses to a key part of the UK’s critical national infrastructure, and was a significant inconvenience for customers.
“Today’s result would not have been possible if TfL had not engaged with law enforcement early, so I would urge any other organisation to please do the same in such circumstances.
“The profile of offenders like Flowers and Jubair demonstrates the increasing threat from cyber criminals based in the UK and other English-speaking countries, epitomised by Scattered Spider.
“This is why we work closely with partners at home and abroad to identify offenders within these networks and bring them to justice.”