Jail for teenage hackers who made millions of pounds

Two teenage hackers who targeted UK celebrities in a £29m TfL cyber attack after making a fortune from blackmail and extortion were jailed for five and a half years each today (thurs).

Thalha Jubair, 19, and Owen Flowers, 18, hacked into the Transport for London servers causing chaos for tens of thousands of Oyster card users, btween 29 August and 6 September 2024.

The hacks prevented live Tube arrival information on TfL Go and the TfL website while online journey history was also unavailable.

TfL was unable to process any payments on the Oyster and contactless apps or to register Oyster cards to customer accounts.

The attack was carried out by members of the online criminal collective known as ‘Scattered Spider.’

Jubair had inadvertently led police to his home at a towerblock in Bow, east London, when he ordered takeaway food from his crypto wallet last September.

Jubair and Flowers admitted conspiracy to commit unauthorised acts in relation to a computer, causing or creating a significant risk of serious damage to human welfare, which carries the maximum of 14 years in jail.

Flowers, who lived with his grandmother in Walsall, also admitted hacking two US healthcare companies, SSM Health Care Corporation and Sutter Health.

During the attack on SSM the teenager sent a message to an associate which said: ‘Smmhealth we might be able to extort with db but locking is risky might kill some 90yr old on life support’.

Mr Justice Turner told the teenagers: ‘You were motivated by selfish bravado. You were broadcasting your activities to a small number of like minded individuals.

He said the potential cost to Tfl ‘as mooted by the prosecution’ was £56bn.

The TfL website was hacked through a system called Citrix, which allowed employees to work from home, Woolwich Crown Court heard.

Prosecutor Mark Fenhalls, KC, described the TfL hack as an ‘unprecedented attack on critical national infrastructure’ adding.

‘The TfL attack was remarkably sophisticated and on a grand scale.

‘The consequences of what they did were extremely serious: both in the disruption to the services offered to the public; and the remedial work that occupied thousands of hours of work by many, many people, and ultimately cost the public purse £29m.’

Mr Fenhalls added: ‘The potential consequential loss of £56bn to the UK economy had they encrypted or destroyed “OneLondon” – a central TfL system to which they did gain administrative rights.’

The hackers had got the ‘Keys to the Kingdom’ and used the credentials of TfL’s Chief Information Security officer.

During the attack, on September 4, Jubair bragged on a forum for hackers stating, “SCATTERED SPIDER IS CREATING WEBS ON THE UNDERGRUND (sic)”, to which FLOWERS responds ‘LOL [laugh out loud] …this was me’.

TfL feared the affect of the hack could be catastrophic and they ‘pulled the plug’ on their whole system.

Mr Fenhalls said: ‘It is possible that access could have been sufficient to enable the actor to cause catastrophic damage to many technology systems, which would have led to significant and extended transport service degradation and disruption.

‘Such widespread disruption would have had a serious impact on the travelling public (including for those accessing education, healthcare and other essential services) and London’s economy.’

The court heard 148 technology systems became inoperable during the hack.

The pair could have installed software which would wipe out TfL’s computer system unless a ransom was paid. .

‘You can only imagine the amount of senior management time and disaster management time that went into dealing with the problem,’ Mr Fenhalls said.

‘The fact of closing down the system and causing 27,000 people to restore passwords in person was extremely significant’.

Mr Fenhalls said that much of what is known of the attack was because the pair filmed themselves in the hack efforts and the videos were recovered.

The videos ‘provide much of the insight into how the two men (and others) worked together and conducted the hack on TfL.’ Mr Fenhalls said.

Flowers continued to attempt to hack into domains on mobile phones borrowed from other prisoners including the CPS, Serco, the Ministry of Defence, HMP Wandsworth and defence company Raytheon.

He also attempted to access the ‘Russian market’ website which sells hacking tools.

Flowers had assets worth nearly a million pounds – £942,260.26 – mainly in the form of cryptocurrency with just £519 in a Barclays account, the rest held in the cyrptocurrencies Monero and Ethereum.

Alan Davis, KC, defending, admitted Flowers was ‘an accomplished hacker’.

But he added he was also ‘an immature child trying to show off online’.

‘He bragged about it in group chats’.

Mr Davis said other hackers were his first friends and trying to impress them was ‘a significant catalyst in his offending.’

Paul Keleher, KC, defending Jubair, said the teenager was ‘like a 21st century Oliver Twist.

‘The Artful Dodger recruited young people to use their nimble fingers to steal from people and he took the proceeds.

Mr Keleher continued: ‘If you can find a child like Jubair you can use his nimble skills for hacking for profit.’

He said Jubair had ‘graduated’ and become the Artful Dodger himself, recruiting young hackers.

Mr Keleher said his client has diagnosis of Autism Spectrum Disorder and was able to ‘hide behind online personalities’.

The hackers used remote servers to hide their identities, created virtual machines within TfL’s network to destroy evidence of their intrusion, and set up multiple secure ‘backdoors’ or tunnels to maintain direct access to the transport authority’s core systems.

They also used ‘social engineering’ to bypass security — tricking the TfL service desk into resetting authentication credentials.

The hackers cloned the domain controller — the system’s gatekeeper— allowing them to harvest user passwords and sensitive data without triggering alarms.

Flowers and Jubair worked together continuously for a 16-hour stretch during the hack.

The damage to TfL’s infrastructure required six months of intensive remedial work to resolve.

Flowers was arrested at his home in Walsall just after 6pm on September 6, 2024.

Investigators found him in his bedroom, actively connected to and hacking the networks of two US healthcare providers — SSM Health and Sutter Health on his laptop.

The National Computer Agency recovered videos on Flowers computer he had recorded of a livestream broadcast by Jubair as they hacked TfL.

The recordings also captured real-time communications between the two on the encrypted messaging app Telegram, where they co-ordinated their roles.

Forensic analysis further linked Jubair to a 2022 credential leak.

Investigators discovered that credentials belonging to a TfL employee, which were stolen via “RedLine Stealer” malware in 2022, were among those used to facilitate the 2024 breach.

Mr Fenhalls said during the hack, the users gained access to the ‘Oyster Professional User System (OPUS)’

Jubair posted ‘“OMG”, “FINALLY”, “HOLY”, “FUCKING”, “SHIT” allowing them to access TfL customer accounts.

Mr Fenhalls said: ‘They searched for and browsed various famous celebrities and viewed their details stored within the system,’ but were unable to fully access credit card details.’

The prosecutor did not name the celebrities the hackers targeted.

Jubair and Flowers both have histories of cyber-related activity.

Flowers was 16 when he was visited at home by the Cyber Choices preventive policing team in October 2023.

Officers served him a cease-and-desist notice regarding his involvement in a US-based “swatting” hoax—where false emergency calls are made to draw an armed police response. Flowers declined to engage with the diversion program at the time.

Flowers held $7.1m including crypto in accounts he controlled, despite having no source of income.

Jubair has convictions involving 22 offences, 13 counts of fraud, two of unauthorised access to a computer, one count of obtaining access to a computer and one count of blackmail.

He was subject to youth rehabilitation order at the time of the TfL offences, which came from his hacking of BT and EE as well as computer chip company Nvidia, which he was convicted for at 17.

Jubair also had a Bangladeshi passport, which he had not declared to the police and which they found hidden down the back of the sofa.

He was arrested for a cyber attack on Europol and Latitude financial services on 16 July 2025.

Jubair is also wanted for seven counts of fraud in the US carrying the maximum of 95 years in jail.

He was also said to have moved $200m worth of crypto through his accounts last year.

Jubair is also said to have targeted members of the US judiciary with threats of blackmail.

The hackers have been diagnosed with autism and Jubair also suffers from depression and a severe mood disorder.

Jubair stood trial with Arion Kurtaj, 20, in 2023 as members of the so-called Lapsus$ group.

Cyber ‘genius’ Kurtaj hacked the gaming firm behind Grand Theft Auto, causing millions of pounds worth of damage, and was detained in a psychiatric hospital indefinitely.

Kurtaj, then 18, stole code and video footage from Rockstar’s development of their latest instalment of GTA6 as part of the multi-million-pound blackmail campaign.

Kurtaj also blackmailed telecoms firm BT/EE, demanding a $4 million ransom.

Along with Jubair they hacked computer chip maker NVIDIA, Uber and the online bank Revolut, between July 2021 and February 2022.

A jury had found Jubair committed a series of acts following a trial.

Jubair, who has ASD (autism spectrum disorder) and was only 14 when the offences began, was sentenced to a youth rehabiliation order for 18 months with three months supervision in December 2023.

He had been convicted by the jury of carrying out an unauthorised act relating to hacking, fraud and blackmail in relation to Nvidia.

Jubair was also convicted of stalking two young women at a youth court and hacking into a City of London Police server.

He is wanted in the US for seven charges including two counts of computer fraud, wire fraud conspiracy, two counts of wire fraud, and money laundering conspiracy.

The charges filed in New Jersey last September claim he took part in relation to at least 120 attacks on computer networks and extortion involving 47 US companies and organisations between May 2022 and September 2025.

The Justice Department alleges victims paid at least $115m (£87m) in ransom payments.

Jubair, is said to have used aliases including “EarthtoStar,” “Brad,” “Austin,” and “@autistic,”.

In October 2024 and January 2025, Jubair allegedly participated in a scheme to gain unauthorized access to the networks of a U.S-based critical infrastructure company and the US Courts.

Portions of the ransom payments from at least five victims were sent to wallets on a server controlled by Jubair.

In July 2024, US law enforcement seized cryptocurrency worth approximately $36 million at the time of the seizure — Jubair transferred a portion of cryptocurrency that originated from one of the victims, worth approximately $8.4 million at the time, to another wallet.

Dean Quick, Deputy Chief Crown Prosecutor for the CPS Serious Economic and Organised Crime’s Regional and Wales Division, said: ‘The convictions of Flowers and Jubair demonstrate our determination and expertise in bringing some of the most complex cybercrime cases before the courts.

‘From the outset, prosecutors worked closely with the National Crime Agency and City of London Police to build a compelling case and ensure those responsible were held to account.

‘The attack on Transport for London’s systems over a single weekend was both sophisticated and relentless.

‘The defendants showed a complete disregard for the disruption and harm their actions could have caused.

‘While TfL successfully thwarted the attack and prevented potentially catastrophic consequences, the impact was still substantial, resulting in £29 million of remedial work and disruption to vulnerable users who relied on services such as Dial-a-Ride.

‘TfL’s swift cooperation with investigators was instrumental in bringing this case to justice and demonstrates the vital role victims can play in helping law enforcement tackle cybercrime.

‘Cybercrime is not a victimless offence. It can disrupt critical services, cause significant financial harm and put lives at risk.

‘This case required an exceptional level of collaboration across agencies and international borders. We thank the National Crime Agency, City of London Police, the West Midlands Regional Organised Crime Unit and British Transport Police for their dedication and expertise.

‘We are also grateful to our partners in Australia, Lithuania, the Netherlands, Romania, Sweden and the United States, whose prompt assistance was invaluable to the investigation.

‘This prosecution is a powerful example of what can be achieved when investigators, prosecutors and international partners work together.

‘Through meticulous investigation and relentless cooperation, they built a case so strong that both defendants ultimately had little option but to admit their crimes.

‘The Crown Prosecution Service remains committed to working with law enforcement partners at home and abroad to bring cybercriminals to justice, wherever they operate and however sophisticated their methods.
ends