TfL cyber hack linked to Shropshire and East London ends in guilty pleas
Pair pleads guilty to £39m data breach impacting thousands
Last updated 15th Jul 2026
Two young hackers are facing potential jail time for orchestrating a cyber attack on Transport for London (TfL) leading to a £39 million loss.
Thalha Jubair, 20, from Tower Hamlets, East London, and Owen Flowers, 18, from Walsall, West Midlands, attacked TfL's online network, causing significant disruption, as approximately 28,000 TfL employees had to reset their passwords, according to the National Crime Agency (NCA).
The sentencing hearing at Woolwich Crown Court is set to begin on 19th July and span over two days.
The cyber attack affected the Oyster refund system, delayed refunds for some customers, and temporarily ceased applications for Oyster photocards for children and young people.
Both defendants were linked to Scattered Spider, a criminal hacking group also involved in attacks on Jaguar Land Rover and retailers such as Marks and Spencer.
Jubair and Flowers initially denied the unauthorised acts under the Computer Misuse Act between 29th August and 6th September 2024, but pleaded guilty before their trial in June.
Additional charges against Flowers include targeting US healthcare companies SSM Health Care Corporation and attempting further unauthorised acts against Sutter Health.
An investigation at Flowers' residence uncovered various electronic devices, including a laptop showing TfL connectivity and user login details for sale.
Recorded videos reportedly show Jubair accessing TfL systems, with the two communicating via Telegram and collaborating in a shared online workspace.
Jubair faced an additional charge of failing to disclose device Pins or passwords, which remains on file.
Mr Justice Turner will preside over the sentencing.