Teenage TfL Cyber Attacker Arrested, Causing £29 Million in Damage While Laughing

A 17-year-old hacker, Owen Flowers, who came perilously close to disabling London’s transport network, was captured on police body-worn camera footage laughing during his arrest. Flowers was apprehended alongside his accomplice, Thalha Jubair, now 20, after breaching Transport for London’s (TfL) online systems over a period from August 31 to September 3, 2024. Their actions resulted in an estimated £29 million worth of “catastrophic damage,” compelling TfL to consider a complete shutdown of its operations.

This extensive intrusion forced all 27,000 TfL employees to report to their offices in person to reset their passwords. At Woolwich Crown Court on Thursday, July 16, both Jubair and Flowers were sentenced to five years and six months in prison. Flowers, now 18, and Jubair were arrested by the National Crime Agency (NCA) at their respective residences during a coordinated operation with the City of London Police. During the arrest, Flowers was seen wearing a grey t-shirt and green shorts, and appeared to chuckle at one of the officers as he was escorted from his home in Walsall, West Midlands.

Contrasting Reactions During Arrest

In stark contrast to Flowers’ nonchalant demeanor, Jubair was seen looking despondent as he was led into a police van from his home in Tower Hamlets, donning a hoodie to shield his face. The NCA reported that Flowers resided with his grandmother and uncle in a three-bedroom house, where he spent the majority of his time gaming and engaging in online chat forums. Investigators suspect that his motivations may have stemmed from a desire for recognition within the cybercriminal community, particularly as no ransom was demanded post-attack.

Both individuals were associated with an online group known as Scattered Spider, which has previously been implicated in cyber attacks on companies such as Jaguar Land Rover and retailers like Marks and Spencer. Jubair’s living situation was characterised by a two-bedroom flat on the third floor of a 21-storey council block in Bow, with his mother employed as a carer and his father working as a care assistant within the local community.

Understanding the Severity of Actions

Taking into account the young age and neurodivergent circumstances of both defendants, the presiding judge expressed confidence that they comprehended the gravity of their actions. The judge noted Jubair’s “history of offending,” highlighting a concerning “level of persistence” and an apparent lack of deterrence by prior investigations. The court learned that the hackers worked intensively for 16 hours overnight to penetrate the TfL systems, having deceived the helpdesk into resetting a password for them.

Once inside, they accessed Microsoft Azure, effectively using TfL’s own systems to exploit their vulnerabilities. Mr Fenhalls, representing the prosecution, stated, “They are both experienced and talented hackers who collaborated with others to target TfL.” Flowers livestreamed Jubair as he executed the hack, and some of this footage was retrieved when Flowers was arrested three days later, on September 6. The two maintained constant communication during their operation, discussing strategies to “nuke access” to the servers as they exited the system.

The Growing Threat of Cybercrime

The NCA has categorised the threat posed by serious and organised cybercrime in the UK as “very high.” While some attacks by UK individuals are driven by a desire for notoriety, the majority are perpetrated by international criminals primarily motivated by financial gain. Data theft continues to be the predominant method of attack in the UK, a trend exacerbated by the increasing reliance on online platforms, as noted by the NCA.

For those seeking further updates from London, subscribing to daily newsletters offers a comprehensive view of the latest developments across the city.