TfL hackers jailed after £39 million cyberattack exposed risks of human error

Two young hackers who infiltrated Transport for London’s most privileged systems have each received five-and-a-half-year prison sentences. The attack compromised data belonging to millions of passengers and demonstrated how a single manipulated support call can place an entire organisation at risk.

Two hackers who penetrated the heart of Transport for London’s technology network have been jailed after an attack that cost the transport authority £39 million and exposed the personal data of about seven million people.

Thalha Jubair, 20, and Owen Flowers, 19, gained the highest level of administrative access to TfL’s systems during a four-day intrusion between 31 August and 3 September 2024.

At Woolwich Crown Court, prosecutors said the pair had reached a position from which they could potentially have locked legitimate administrators out of the network and caused widespread disruption. They created a domain administrator account, giving them control described during proceedings as the “keys to the kingdom”.

Both received sentences of five and a half years. Jubair was sentenced for his role in the TfL attack, while Flowers’s sentence also covered attacks against two healthcare providers in the United States.

Mr Justice Turner said their actions were driven primarily by “selfish bravado”, without regard for the serious consequences facing passengers, employees and the wider public.

Stolen credentials opened the door

The attack began not with a highly sophisticated piece of malware, but with social engineering.

According to evidence presented in court, an unidentified accomplice contacted TfL’s IT help desk using stolen employee login details. Pretending to be a member of staff who was having difficulty connecting remotely, the caller persuaded a support worker to reset the authentication process and register a device controlled by the attackers.

Once inside, Jubair and Flowers worked to increase their permissions until they reached the organisation’s most sensitive administrative systems.

The incident highlights a central challenge facing modern organisations. Strong technology can still be undermined when an employee is deceived into granting access, resetting an account or bypassing an established security process.

During the intrusion, the hackers communicated through Telegram. Flowers also recorded a livestream of the attack, which Jubair broadcast while the intrusion was taking place.

Prosecutors said the pair searched TfL’s customer records for information about celebrities. They also accessed systems containing data belonging to millions of passengers.

TfL ultimately stopped the attack by disconnecting systems and taking extensive defensive measures. Around 27,000 employees were required to reset their passwords as the organisation worked to secure and rebuild its network.

Passenger services disrupted

London’s main Tube and bus services continued operating, but several customer-facing systems were affected.

Live Underground arrival information disappeared from the TfL Go app and website. Passengers were temporarily unable to make payments through Oyster and contactless applications or register Oyster cards to their online accounts.

Dial-a-Ride, which provides transport for passengers with disabilities and mobility needs, was also unable to process bookings for a period.

TfL estimated that the incident caused £29 million in damage to its technology systems and a further £10 million in lost income.

The organisation warned that the potential consequences could have been considerably worse. Had the attackers used their privileged access to destroy systems, remove legitimate administrators or interfere more extensively with operations, TfL said London could have faced prolonged transport disruption.

TfL commissioner Andy Lord described it as the most serious incident he had encountered during his career.

Members of the Scattered Spider network

Jubair and Flowers were identified as prominent participants in the loose English-speaking cybercriminal community known by security researchers as Scattered Spider.

The name refers to a network rather than a conventional criminal organisation with a clear hierarchy. Individuals associated with it have been linked to attacks in which employees and support teams are manipulated into providing access to corporate networks.

Messages exchanged during the TfL intrusion showed that the two defendants had adopted the Scattered Spider identity themselves.

The National Crime Agency said their convictions had effectively brought the group’s criminal activity to a halt, although the wider methods associated with such online communities remain a significant concern for organisations.

The court also heard that large amounts of cryptocurrency had passed through accounts controlled by the defendants. Despite this, neither appeared to maintain an obviously extravagant lifestyle. Prosecutors and security specialists suggested that status, recognition and online bragging rights were important motivations alongside financial gain.

In one message sent during the TfL attack, Flowers warned Jubair: “u won’t be laughing when ur sat in prison.”

A warning for every organisation

The TfL incident is not simply a story about two young people with advanced computer skills. It is a warning about the speed with which stolen credentials, weak verification procedures and excessive account privileges can combine to create an organisational crisis.

The attackers did not initially need to defeat every security control. They needed to convince one person that they were a legitimate employee.

That makes cybersecurity awareness relevant to everyone, not only IT departments.

Receptionists, finance teams, contractors, executives, customer service representatives and help desk employees can all be targeted. Criminals may impersonate colleagues, suppliers, senior managers or technical support workers. They often create urgency, apply pressure and use fragments of genuine personal information to make their stories more convincing.

Businesses should regularly review how password resets, multifactor authentication changes and remote access requests are approved. Employees must also be able to recognise suspicious behaviour and feel confident challenging unusual requests, even when the person making them appears convincing.

Technical protections remain essential, including multifactor authentication, network segmentation, restricted administrator privileges, effective monitoring and a tested incident response plan. However, these measures are strongest when employees understand the threats they are designed to prevent.

Turn awareness into a practical defence

The cost of training employees is small compared with the financial, operational and reputational damage caused by a major cyber incident.

The Hack Academy’s online cybersecurity training programme helps businesses and individuals recognise real-world threats, including phishing, social engineering, credential theft and account compromise. The programme is designed to turn cybersecurity from an abstract technical issue into practical knowledge that people can apply in their everyday work and personal lives.

Do not wait for a suspicious call, compromised password or damaging breach to expose weaknesses in your defences.

Strengthen your organisation’s human firewall and reduce your personal risk by enrolling in The Hack Academy’s online training programme today.