Teen hackers convicted for £39 million Transport for London cyber-attack

Two teenagers were convicted at Woolwich Crown Court over a cyber-attack on Transport for London that left the transport authority facing an estimated £39 million bill. Owen Flowers, from Walsall, and Thalha Jubair, from East London, were linked to the hacking group Scattered Spider and to a breach that hit one of London’s most essential public services.

The case has also raised sharper questions about what happened before the attack. Reporting has shown both boys were known to police years earlier, a detail that points to missed opportunities to intervene before digital offending escalated into a major strike on public infrastructure.

Investigators said TfL’s network was infiltrated between 31 August and 3 September 2024, while other reporting placed the hacking activity from 29 August to 6 September. The National Crime Agency described the episode as a cyber-attack on TfL’s computer network, underscoring the scale of the intrusion into a system that keeps the capital moving.

The financial damage was heavy and long-lasting. Transport for London estimated the hit at about £39 million, while other assessments put the total between £29 million and £39 million once recovery expenses and lost revenue were included. TfL is the capital’s transport authority responsible for London’s transport network, so the breach carried consequences far beyond a single agency balance sheet. It exposed how quickly teenage cybercrime can move from online misconduct to disruption of a national-scale public service.