Owen Flowers, 18, and Thalha Jubair, 20, have each received five-and-a-half-year prison sentences following their involvement in a significant cyber-attack against Transport for London (TfL). The pair, who pleaded guilty in June, were identified as members of the cyber-crime collective known as Scattered Spider.

The breach, which began on August 31, 2024, involved the hackers tricking a help desk employee into resetting credentials, allowing them to infiltrate TfL’s internal systems. The 16-hour attack was live-streamed by the perpetrators, who boasted about their actions via encrypted messaging apps. The incident resulted in the theft of personal data belonging to up to 10 million customers and forced all 27,000 TfL employees to reset their passwords.

TfL reported that the attack rendered 148 technology systems inoperable, causing widespread service disruptions, including to the Dial-a-ride service for vulnerable passengers. The financial impact of the breach is estimated at £39 million, split between £29 million in operational costs and £10 million in lost revenue.

Woolwich Crown Court heard that both men were socially isolated individuals who spent significant time unsupervised online. Judge Mr Justice Turner noted their young age and autism diagnoses as mitigating factors. Despite their youth, both defendants had prior histories of cyber-related offenses. Jubair, who had 22 previous convictions, was also linked to the Lapsus$ hacking group and faces potential legal action in the United States regarding alleged ransom payments totaling $115 million.

Authorities noted that while the men had accumulated approximately £1 million in cryptocurrency, their primary motivation appeared to be online notoriety. Following their arrests, investigators discovered that both men had attempted to coordinate further cyber-attacks using contraband phones while in custody awaiting trial. The National Crime Agency (NCA) stated that the arrests have significantly disrupted the Scattered Spider collective, though experts warn that the culture of youth-led cyber-crime remains a persistent challenge.

Source: BBC News