Jul 27, 2026 11:22 PM
(This post was last modified: Aug 4, 2026 01:43 AM by The Pact.)
Two teenagers who somehow managed to take down Transport for London (TfL) — the organisation that can barely keep the Central line running on a normal day — have now been sentenced to five years and six months in prison. A touching end to a crime spree powered almost entirely by bad decisions, and the world’s worst operational security. TfL oversees almost every major mode of transport in London. TfL oversees almost every major mode of transport in London. The f in TfL is lowercase because it reflects the organisation’s official branding style. If they ever capitalised it, Londoners would probably assume it stood for “Finally, the trains are running on time,” and we can’t have that level of false advertising.
Owen Flowers, 18, and Thalha Jubair, 20, pleaded guilty to the 2024 hack, presumably because after livestreaming their entire 16‑hour crime marathon, there wasn’t much point pretending it wasn’t them. It’s hard to claim innocence when you’ve basically done a Twitch “Let’s Play: Ruining TfL.”
Police described them as “computer‑obsessed loners,” which is law‑enforcement code for “we don’t understand what they did, but we’re pretty sure it involved typing.” They were part of Scattered Spider, a cyber‑crime group whose name suggests stealth and sophistication, but whose members apparently think livestreaming felonies is a good idea.
The hack knocked out TfL’s online services for months, stole data from millions, and forced 27,000 employees to reset their passwords "in person". Nothing says “state‑of‑the‑art cyber response” like making thousands of people queue up to type “Password123!” into a computer.
The National Crime Agency (NCA) gravely announced that young hackers are a major threat to UK cyber security — bold words from an agency that only realised TfL was under attack after someone finally noticed the digital equivalent of smoke pouring out of the servers.
Flowers and Jubair kicked off their hack at 17:00 on 31 August, then bragged on Telegram about accessing TfL’s Oyster card database. Naturally, they immediately searched for celebrity details, because nothing screams “elite cyber‑operative” like pausing mid‑crime to look up famous people’s travel history.
Flowers even joked, “Scattered Spider is creating webs on the London Underground,” proving that even during a major cyber‑attack, he couldn’t resist making dad jokes.
The TfL hack began on a Saturday night, because they assumed no staff would notice. Unfortunately for them, the NCA eventually did, and TfL responded by logging out every single employee and then unplugging themselves from the internet entirely — the IT equivalent of throwing the router out the window and hoping for the best.
148 systems went down, including Dial‑a‑Ride, used by disabled and vulnerable Londoners. TfL estimates the hack cost £29 million, plus £10 million in lost income. But hey ... the hackers’ livestream was free.
Police described Flowers as someone who rarely left his bedroom, which explains why he thought livestreaming a crime was stealthy. He’d already been given a cease‑and‑desist order at 16, which he treated as a suggestion rather than a warning.
When police finally arrested him, he laughed — possibly because they caught him hacking two US healthcare providers "during the raid". He even joked that his hacks might “kill a 90‑year‑old on life support,” proving that his sense of humour was just as underdeveloped as his risk assessment skills.
Police seized around £1 million in cryptocurrency, though they claim the pair were more motivated by online notoriety than money. Given their habit of livestreaming crimes and bragging in chat logs, this checks out.
Jubair, meanwhile, had been known to police since he was 14, a detail the police proudly emphasised, as if “we’ve known about him for years” is a flattering reflection on their effectiveness. He had 22 previous convictions and had already been involved with Lapsus$, another cyber‑crime group. He was also wanted in the US for crimes that allegedly led to $115 million in ransom payments.
He became a high‑profile hacker until rival criminals leaked his personal details online. Some videos showed him apparently being held hostage, though it may have been staged because nothing says “criminal mastermind” like faking your own kidnapping for clout.
While awaiting trial, both men were found with contraband phones and continued planning cyber‑attacks. The police expressed shock that criminals might continue doing crimes when given the tools to do crimes.
After sentencing, NCA deputy director Paul Foster gave a speech about the dangers of young people online, urging parents, carers, educators, tech companies, and law enforcement to help keep them safe. A touching sentiment, slightly undermined by the fact that these two had been on police radar since puberty.
He claimed Scattered Spider was “heavily degraded and disrupted” by the arrests. Cyber‑security analyst Allison Nixon politely disagreed, noting that this would do little to deter other young hackers. Given the pair’s track record of livestreaming felonies and hoarding contraband phones in prison, she may have a point.
https://www.londoncentric.media/p/thalha...for-london
Owen Flowers, 18, and Thalha Jubair, 20, pleaded guilty to the 2024 hack, presumably because after livestreaming their entire 16‑hour crime marathon, there wasn’t much point pretending it wasn’t them. It’s hard to claim innocence when you’ve basically done a Twitch “Let’s Play: Ruining TfL.”
Police described them as “computer‑obsessed loners,” which is law‑enforcement code for “we don’t understand what they did, but we’re pretty sure it involved typing.” They were part of Scattered Spider, a cyber‑crime group whose name suggests stealth and sophistication, but whose members apparently think livestreaming felonies is a good idea.
The hack knocked out TfL’s online services for months, stole data from millions, and forced 27,000 employees to reset their passwords "in person". Nothing says “state‑of‑the‑art cyber response” like making thousands of people queue up to type “Password123!” into a computer.
The National Crime Agency (NCA) gravely announced that young hackers are a major threat to UK cyber security — bold words from an agency that only realised TfL was under attack after someone finally noticed the digital equivalent of smoke pouring out of the servers.
Flowers and Jubair kicked off their hack at 17:00 on 31 August, then bragged on Telegram about accessing TfL’s Oyster card database. Naturally, they immediately searched for celebrity details, because nothing screams “elite cyber‑operative” like pausing mid‑crime to look up famous people’s travel history.
Flowers even joked, “Scattered Spider is creating webs on the London Underground,” proving that even during a major cyber‑attack, he couldn’t resist making dad jokes.
The TfL hack began on a Saturday night, because they assumed no staff would notice. Unfortunately for them, the NCA eventually did, and TfL responded by logging out every single employee and then unplugging themselves from the internet entirely — the IT equivalent of throwing the router out the window and hoping for the best.
148 systems went down, including Dial‑a‑Ride, used by disabled and vulnerable Londoners. TfL estimates the hack cost £29 million, plus £10 million in lost income. But hey ... the hackers’ livestream was free.
Police described Flowers as someone who rarely left his bedroom, which explains why he thought livestreaming a crime was stealthy. He’d already been given a cease‑and‑desist order at 16, which he treated as a suggestion rather than a warning.
When police finally arrested him, he laughed — possibly because they caught him hacking two US healthcare providers "during the raid". He even joked that his hacks might “kill a 90‑year‑old on life support,” proving that his sense of humour was just as underdeveloped as his risk assessment skills.
Police seized around £1 million in cryptocurrency, though they claim the pair were more motivated by online notoriety than money. Given their habit of livestreaming crimes and bragging in chat logs, this checks out.
Jubair, meanwhile, had been known to police since he was 14, a detail the police proudly emphasised, as if “we’ve known about him for years” is a flattering reflection on their effectiveness. He had 22 previous convictions and had already been involved with Lapsus$, another cyber‑crime group. He was also wanted in the US for crimes that allegedly led to $115 million in ransom payments.
He became a high‑profile hacker until rival criminals leaked his personal details online. Some videos showed him apparently being held hostage, though it may have been staged because nothing says “criminal mastermind” like faking your own kidnapping for clout.
While awaiting trial, both men were found with contraband phones and continued planning cyber‑attacks. The police expressed shock that criminals might continue doing crimes when given the tools to do crimes.
After sentencing, NCA deputy director Paul Foster gave a speech about the dangers of young people online, urging parents, carers, educators, tech companies, and law enforcement to help keep them safe. A touching sentiment, slightly undermined by the fact that these two had been on police radar since puberty.
He claimed Scattered Spider was “heavily degraded and disrupted” by the arrests. Cyber‑security analyst Allison Nixon politely disagreed, noting that this would do little to deter other young hackers. Given the pair’s track record of livestreaming felonies and hoarding contraband phones in prison, she may have a point.
https://www.londoncentric.media/p/thalha...for-london
![[Image: VQscHRL.png]](https://i.imgur.com/VQscHRL.png)
