Two teenage hackers were sentenced to five and a half years in prison on Thursday for a major cyberattack that crippled Transport for London's IT systems and cost the agency £39 million.
Thalha Jubair, 20, and Owen Flowers, 19, pleaded guilty in June to the breach, which occurred between August 31 and September 3, 2024, according to The Guardian.
>>> Trump Meets Newly Appointed Senator Darline Graham in Washington
The cyberattack compromised the personal data of approximately 7 million passengers, disrupted dial-a-ride booking systems for disabled users, and forced 27,000 transport staff members to reset their computer passwords.
Prosecutors at Woolwich Crown Court said the hackers created a domain administrator account that granted them the highest level of system access, effectively giving them the keys to the kingdom.
The total financial damage consisted of £29 million in direct IT system repair costs and an additional £10 million in lost revenue for the transit authority.
Both defendants have autism diagnoses and were identified as key participants in Scattered Spider, an English-speaking cybercriminal collective that accumulated millions in cryptocurrency.
Flowers had previously ignored a cease-and-desist warning from West Midlands police in October 2023 and rejected rehabilitation training aimed at guiding him away from digital crime.
>>> CDC Downgrades Cyclospora Surveillance Amid Major Outbreak
During the coordinated breach, Flowers complained about the operation's speed through the encrypted Telegram messaging app.
Jubair broadcast a message during a live stream of the attack: "SCATTERED SPIDER IS CREATING WEBS ON THE UNDERGRND."
Flowers predicted to his co-defendant in a chat message: "u won't be laughing when ur sat in prison."
Paul Foster, head of the National Crime Agency's National Cyber Crime Unit, said: "Their activities and their impact have now been severely degraded as a result of this action."
>>> Uber to Acquire Delivery Hero in $14.8 Billion Global Expansion Deal
Officials stated that the successful prosecution has severely disrupted the broader Scattered Spider hacking network.
