Two young hackers who infiltrated Transport for London’s computer systems posed a potential £56 billion threat to the UK economy after gaining the highest level of access to the transport network, a court has heard. Thalha Jubair, 20, and Owen Flowers, 18, admitted carrying out a sophisticated cyber attack on Transport for London (TfL) between 31 August and 3 September 2024, which ultimately cost the organisation £29 million. The pair appeared before Woolwich Crown Court, where prosecutors said they gained complete control of TfL’s systems after tricking helpdesk staff into resetting a password.
‘Keys to the kingdom’
Prosecutor Mark Fenhalls KC told the court the hackers achieved the highest level of privileged access, often described in cybersecurity as obtaining the “keys to the kingdom“. This gave them unrestricted control over TfL’s networks and the ability to deploy ransomware across the organisation. Faced with the threat of a catastrophic attack, TfL shut down its systems and forced all 27,000 employees to reset their passwords in an emergency response. The court heard that had the attackers encrypted or destroyed TfL’s core systems, the resulting disruption could have caused an estimated £56 billion in economic damage across the UK. TfL warned such an attack would have caused prolonged disruption to London’s transport network, affecting commuters, businesses and access to essential services including healthcare and education.
Livestreamed attack
The court heard Jubair and Flowers worked through the night for around 16 hours to gain access to the network. Flowers allegedly livestreamed the attack online while Jubair carried out the intrusion. Investigators later recovered videos from Flowers’ devices following his arrest on 6 September 2024. During the hack, the pair discussed “nuking access” to TfL’s servers before leaving the network. Prosecutors said they used remote servers to disguise their identities, created virtual machines to destroy evidence, downloaded millions of lines of data and installed multiple backdoors to maintain future access. Mark Fenhalls KC said:
“They were utterly reckless about the consequences of hacking TfL, the transport network and the communications for the country.
“It only came to an end because TfL threw them out rather than they chose to stop.”
Linked to Scattered Spider
The court heard both defendants were linked to the cybercrime group Scattered Spider, which has been associated with high-profile attacks on major organisations including Marks & Spencer and the Co-op. Jubair’s barrister argued his client had been groomed into cybercrime from a young age, comparing him to a “modern-day Oliver Twist”. However, Mr Justice Turner rejected the comparison, telling the court:
“There’s no Fagin in this case; it’s a Faginless crime.
“He has an audience but he doesn’t have a puppet master; he’s promoted himself to an instigator and perpetrator.”
Flowers’ defence said he was an immature teenager attempting to impress others online. However, prosecutors revealed that when police seized his laptop, it was actively being used to hack two healthcare providers in the United States — SSM Health and Sutter Health. Those attacks were only prevented because of the timing of his arrest.
Prison misconduct
The court also heard that after being remanded into custody in September 2025, Flowers obtained two illicit mobile phones while in prison and searched for login details relating to the Ministry of Justice, Wandsworth Prison staff and the Crown Prosecution Service. Jubair, from east London, had already been sentenced last year for 22 separate cybercrime offences, including attacks targeting individuals, telecommunications companies and the City of London Police. Both men admitted conspiracy to commit unauthorised acts in relation to a computer causing or creating a risk of serious damage. Flowers, from Walsall, also admitted two further offences relating to conspiracy to impair computer systems connected to the two US healthcare organisations. Both defendants are due to be sentenced on Thursday.
