Teenage hackers went for celebrities in TfL attack after making millions blackmailing companies

Two teenage hackers targeted UK celebrities in a £29m TfL cyber attack after making tens millions of pounds from blackmail and extortion, a court heard.

Thalha Jubair, 19, and Owen Flowers, 18, hacked into the Transport for London servers between 29 August and 3 September 2024, causing chaos for Oyster card users.

The hacks prevented live Tube arrival information on TfL Go and the TfL website while online journey history was also unavailable.

TfL was unable to process any payments on the Oyster and contactless apps or to register Oyster cards to customer accounts.

The attack was carried out by members of the online criminal collective known as ‘Scattered Spider.’

Jubair, of Bow, east London, and Flowers admitted conspiracy to commit unauthorised acts in relation to a computer, causing or creating a significant risk of serious damage to human welfare, which carries the maximum of 14 years in jail.

Flowers, who lived with his grandmother in Walsall, also admitted hacking two US healthcare companies, SSM Health Care Corporation and Sutter Health.

Prosecutor Mark Fenhalls KC described the TfL hack as an ‘unprecedented attack on critical national infrastructure’ adding.

‘The TfL attack was remarkably sophisticated and on a grand scale.

‘The consequences of what they did were extremely serious: both in the disruption to the services offered to the public; and the remedial work that occupied thousands of hours of work by many, many people, and ultimately cost the public purse £29m.’

The hackers used remote servers to hide their identities, created virtual machines within TfL’s network to destroy evidence of their intrusion, and set up multiple secure ‘backdoors’ or tunnels to maintain direct access to the transport authority’s core systems.

They also used ‘social engineering’ to bypass security — tricking the TfL service desk into resetting authentication credentials.

The hackers cloned the domain controller —the system’s gatekeeper— allowing them to harvest user passwords and sensitive data without triggering alarms.

Flowers and Jubair worked together continuously for a 16-hour stretch during the hack.

The damage to TfL’s infrastructure required six months of intensive remedial work to resolve.

Flowers was arrested at his home in Walsall just after 6pm on September 6, 2024.

Investigators found him in his bedroom, actively connected to and hacking the networks of two US healthcare providers — SSM Health and Sutter Health on his laptop.

The National Computer Agency recovered videos on Flowers computer he had recorded of a livestream broadcast by Jubair as they hacked TfL.

The recordings also captured real-time communications between the two on the encrypted messaging app Telegram, where they co-ordinated their roles.

Forensic analysis further linked Jubair to a 2022 credential leak.

Investigators discovered that credentials belonging to a TfL employee, which were stolen via “RedLine Stealer” malware in 2022, were among those used to facilitate the 2024 breach.

Mr Fenhalls said during the hack, the users gained access to the ‘Oyster Professional User System (OPUS)’

Jubair posted ‘“OMG”, “FINALLY”, “HOLY”, “FUCKING”, “SHIT” allowing them to access TfL customer accounts.

Mr Fenhalls said: ‘They searched for and browsed various famous celebrities and viewed their details stored within the system,’ but were unable to fully access credit card details.’

The prosecutor did not name the celebrities the hackers targeted.

Jubair and Flowers both have histories of cyber-related activity.

Flowers was 16 when he was visited at home by the Cyber Choices preventive policing team in October 2023.

Officers served him a cease-and-desist notice regarding his involvement in a US-based “swatting” hoax—where false emergency calls are made to draw an armed police response. Flowers declined to engage with the diversion program at the time.

Flowers held $7.1m including crypto in accounts he controlled, despite having no source of income.

Jubair has convictions involving 22 offences, 13 counts of fraud, two of unauthorised access to a computer, one count of obtaining access to a computer and one count of blackmail.

He was subject to youth rehabilitation order at the time of the TfL offences, which came from his hacking of BT and EE as well as computer chip company Nvidia, which he was convicted for at 17.

Jubair also had a Bangladeshi passport, which he had not declared to the police and which they found hidden down the back of the sofa.

He was arrested for a cyber attack on Europol and Latitude financial services on 16 July 2025.

Jubair is also wanted for seven counts of fraud in the US carrying the maximum of 95 years in jail.

During a hearing at Westminster Magistrates’ Court last September prosecutor Alistair Richardson said when he was released from custody in March 2025, $10m was moved from his wallets, and $200m worth of crypto has moved through accounts belonging to Mr Jubair.’

Jubair is also said to have targeted members of the US judiciary with threats of blackmail.

Both defendants have been diagnosed with autism and Jubair also suffers from depression and a severe mood disorder.

Jubair stood trial with Arion Kurtaj, 20, in 2023 as members of the so-called Lapsus$ group.

Cyber ‘genius’ Kurtaj hacked the gaming firm behind Grand Theft Auto, causing millions of pounds worth of damage, and was detained in a psychiatric hospital indefinitely.

Kurtaj, then 18, stole code and video footage from Rockstar’s development of their latest instalment of GTA6 as part of the multi-million-pound blackmail campaign.

Kurtaj also blackmailed telecoms firm BT/EE, demanding a $4 million ransom.

Along with Jubair they hacked computer chip maker NVIDIA, Uber and the online bank Revolut, between July 2021 and February 2022.

A jury had found Jubair committed a series of acts following a trial.

Jubair, who has ASD (autism spectrum disorder) and was only 14 when the offences began, was sentenced to a youth rehabiliation order for 18 months with three months supervision in December 2023.

He had been convicted by the jury of carrying out an unauthorised act relating to hacking, fraud and blackmail in relation to Nvidia.

Jubair was also convicted of stalking two young women at a youth court and hacking into a City of London Police server.

He is wanted in the US for charges which attract a maximum 95-year prison sentence.

Jubair is charged with computer fraud conspiracy, two counts of computer fraud, wire fraud conspiracy, two counts of wire fraud, and money laundering conspiracy.

The charges filed in New Jersey last September claim he took part in relation to at least 120 attacks on computer networks and extortion involving 47 U.S. companies and organisations between May 2022 and September 2025.

The Justice Department alleges victims paid at least $115million (£87million) in ransom payments.

Jubair, is said to have used aliases including “EarthtoStar,” “Brad,” “Austin,” and “@autistic,”.

In the US he is alleged to have conspired with others to use social engineering techniques to gain unauthorized access into the computer networks of U.S. companies, steal and encrypt information, and demand ransom payments from victims in exchange for regaining control and preventing the dissemination of the exfiltrated data.

Jubair is also charged with conspiring with others to launder the funds obtained through this scheme.

In October 2024 and January 2025, Jubair allegedly participated in a scheme to gain unauthorized access to the networks of a U.S.-based critical infrastructure company and the U.S. Courts.

Portions of the ransom payments from at least five victims were sent to wallets on a server controlled by Jubair.

In July 2024, while law enforcement was seizing that server — including successfully seizing cryptocurrency worth approximately $36 million at the time of the seizure — Jubair transferred a portion of cryptocurrency that originated from one of the victims, worth approximately $8.4 million at the time, to another wallet.

Mr Fenhalls added: ‘The potential consequential loss of £56bn to the UK economy had they encrypted or destroyed “OneLondon” – a central TfL system to which they did gain administrative rights.’

The court heard that the hackers had got the ‘Keys to the Kingdom’ and used the credentials of TfL’s Chief Information Security officer.

At one stage during the attack, at 8 05pm on September 4, Jubair bragged on a forum for hackers stating, “SCATTERED SPIDER IS CREATING WEBS ON THE UNDERGRUND (sic)”, to which FLOWERS responds ‘LOL [laugh out loud] …this was me’.

TfL feared the affect of the hack could be catastrophic and they ‘pulled the plug’ on their whole system.

Mr Fenhalls said: ‘It is possible that access could have been sufficient to enable the actor to cause catastrophic damage to many technology systems, which would have led to significant and extended transport service degradation and disruption.

‘Such widespread disruption would have had a serious impact on the travelling public (including for those accessing education, healthcare and other essential services) and London’s economy.’

The court heard 148 technology systems became inoperable during the hack.

The pair could have installed software which would wipe out TfL’s computer system unless a ransom was paid. .

‘You can only imagine the amount of senior management time and disaster management time that went into dealing with the problem,’ Mr Fenhalls said.

‘The fact of closing down the system and causing 27,000 people to restore passwords in person was extremely significant’.

Mr Fenhalls said that much of what is known of the attack was because the pair filmed themselves in the hack efforts and the videos were recovered.

The videos ‘provide much of the insight into how the two men (and others) worked together and conducted the hack on TfL.’ Mr Fenhalls said.

Flowers continued to attempt to hack into domains on mobile phones borrowed from other prisoners including the CPS, Serco, the Ministry of Defence, HMP Wandsworth and defence company Raytheon.

He also attempted to access the ‘Russian market’ website which sells hacking tools.

The court heard that Flowers had assets worth nearly a million pounds – £942,260.26 – mainly in the form of cryptocurrency with just £519 in a Barclays account, the rest held in the cyrptocurrencies Monero and Ethereum.

Alan Davis KC, defending admitted Flowers was ‘an accomplished hacker’.

But he added he was also ‘an immature child trying to show off online’.

‘He bragged about it in group chats’.

Mr Davis said other hackers were his first friends and trying to impress them was ‘a significant catalyst in his offending.’

The pair will be sentenced tomorrow. (Thurs)