Culture news and discussion on TalkFuse.
‘Keys to the kingdom’: hackers who gained access to heart of London transport network jailed
Two hackers, Thalha Jubair, 20, and Owen Flowers, 19, have each been jailed for five and a half years after a 2024 cyber-attack that gave them extensive access to Transport for London's IT systems, costing TfL an estimated £39m. The pair, described in court as having obtained "the keys to the kingdom", exploited a domain admin account to gain the highest level of privileged access, putting them in a position to shut down TfL's systems entirely before the operator pulled the plug to contain the breach. The case highlights the vulnerability of critical infrastructure to determined young hackers operating from ordinary homes, and TfL's chief, Andy Lord, called it the worst incident of his career.
The four-day attack, between 31 August and 3 September 2024, stole data belonging to millions of commuters, disrupted payment systems and forced 27,000 TfL staff to reset their passwords, though the main tube and bus networks kept running. Jubair, from Bow in east London, and Flowers, from Walsall, coordinated via Telegram and were part of the hacking collective Scattered Spider, having amassed millions of dollars in cryptocurrency. Flowers was also sentenced for hacking two US healthcare providers, and both men pleaded guilty in June ahead of Thursday's sentencing.
In short
- Two teenage hackers jailed 5.5 years each over TfL cyber-attack
- 2024 breach cost TfL £39m and exposed millions of commuters' data
- Pair linked to Scattered Spider hacking collective, made millions in crypto
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
These sentences appropriately reflect the gravity of a coordinated attack on critical national infrastructure, where the perpetrators obtained the highest level of system access and caused £39m in damage. Given the sophistication, intent, and genuine threat to public safety posed by attacks on essential services millions depend on, strong sentences are necessary both for justice and to deter similar crimes. Age alone should not substantially excuse such deliberate harm to critical infrastructure.
The case against
These first-time offenders in their late teens and early twenties caused no direct physical harm, and sentences of this length raise legitimate questions about proportionality and focus. Young people's developing brains make them particularly suited to rehabilitation rather than lengthy incarceration, and such sentences may entrench criminality rather than redirect their evident technical abilities. Many argue that a more constructive approach would better serve both the individuals and society.
Explained simply
Transport for London's computer systems were breached in a cyber-attack between late August and early September 2024. Two hackers gained access to the core IT infrastructure running London's buses and underground trains, stealing personal data belonging to millions of commuters and disrupting payment systems.
The attack exposed the vulnerability of critical infrastructure to determined hackers. The attackers obtained the highest level of system access available, putting them in a position where they could have shut down the entire transport network, although TfL staff managed to contain the breach before that happened. The attack cost Transport for London an estimated £39m to investigate and repair.
Two young men, Thalha Jubair, 20, and Owen Flowers, 19, were responsible for the breach. They were part of an international hacking group and coordinated their attack from ordinary homes in London and the Midlands, showing that critical infrastructure can be threatened by hackers operating remotely.
Art Business Culture Cybersecurity Technology