Two teenagers jailed for hacking Transport for London
Two teenagers were sentenced to prison for hacking Transport for London's network, causing significant financial damage and a data breach.
The Full Story
A plain summary built from the channels that reported this story.
Two teenagers have been jailed for more than five years after hacking into Transport for London's (TfL) computer network in a cyber attack that caused months of disruption and cost the operator tens of millions of pounds.
Owen Flowers, 18, from Warsaw, and Talha Joubert, 20, from east London, carried out the attack in August 2024. They spent 16 hours overnight breaking into TfL's systems, starting at 5pm on a Saturday to avoid detection. They streamed the entire hack online for other hackers to watch.
The pair gained deep access to TfL's network and stole the personal data of millions of customers. The court heard they became excited when they found a database containing at least 6 million entries, possibly as many as 10 million. They did not try to sell the data or demand a ransom. Their motive was notoriety and online fame.
TfL was forced to take what the judge described as extreme and desperate measures to kick the hackers out, including disconnecting vital systems from the internet. Tube, train and bus services were not affected, but many online services were disrupted for weeks. The Dial-A-Ride service for vulnerable Londoners was particularly badly hit. All 27,000 TfL staff had to undergo physical security checks at offices before they could get back online.
The total cost to TfL was put at between £29 million and £39 million, covering recovery costs and lost business.
Both men pleaded guilty on the first day of their trial. The judge said their actions were motivated by selfish bravado, heedless of the severe consequences to others. He took their young ages and neurodivergence into account but sentenced them to five years and six months in prison.
Flowers and Joubert were members of a loose hacking collective known as Scattered Spider, which has been linked to attacks on Marks & Spencer and Jaguar Land Rover. When Flowers was arrested at his home in Warsaw, he was in the middle of carrying out further attacks on two US healthcare providers.
The National Crime Agency described this as its largest and most complex cybercrime investigation to date, and the largest criminal prosecution of cyber offenders in UK history. Police warned that homegrown hackers like these remain one of the biggest threats to the UK and that more than law enforcement action is needed to stop young people falling into cybercrime.
On screen
Stills are sampled automatically at 60-second intervals. Where shown, the still is the nearest available frame from the relevant broadcast segment and is included to show what was on screen during that part of the broadcast. A still may not correspond to the exact second of a quoted phrase.
Key Claims
Claims reported during this story's coverage, mapped by channel. Ordered by how many channels carried each claim.
| Claim | Channel 5 | BBC One | ITV |
|---|---|---|---|
| The attack cost Transport for London between 29 million and 39 million pounds. | |||
| The hackers were part of the group Scattered Spider. | |||
| The hackers searched for celebrity data and attempted to access bank information. | · | ||
| The hackers stole personal data of millions of people. | · | ||
| The hackers streamed their hacking activities online. | · |
Channel Perspectives
What each channel focused on, with key quotes.
The BBC focused on the technical details of the hack, the judge's description of it as an exercise in selfish bravado, and the broader threat from the Scattered Spider group. It also highlighted the impact on vulnerable Londoners via Dial-A-Ride and the NCA's view that this was the largest cybercrime prosecution in UK history.
- “the judge described this hack as an exercise in selfish provided that could have caused travel chaos across London.”
- “they were really enjoying themselves, at one point getting very excited when they found a customer database containing at least 6 million, possibly as many as 10 million entries for TfL customers.”
- “The National Crime Agency describes this as their largest cybercrime case to date, and they say that homegrown hackers like these, linked to the loose collective scattered spider, remain one of the biggest threats to the UK.”
ITV emphasised the lack of financial motive and the desire for notoriety, the use of social engineering to trick TfL staff, and the higher cost figure of £39 million. It also noted that the pair were part of Scattered Spider, which had been blamed for attacks on M&S and Jaguar Land Rover.
- “There was no financial motive. Just notoriety.”
- “As well as code, they used social engineering, tricking people, including the help desk, into resetting a new password for them.”
- “Flowers and Joubert were part of a loosely connected group of hackers called Scattered Spider, blamed for attacks on M&S and Jaguar Land Rover.”
Channel 5 focused on the human impact, including the stress on cyber defenders and the need for young people to understand the seriousness of cybercrime. It also highlighted that the pair searched for celebrity details and tried to access their bank information. The report misnamed one defendant as Tyler Dubert.
- “I think it's worth definitely recognising the stress that cyber attacks like this can put on people that are in critical roles in businesses.”
- “As they boasted to each other online, they then searched the hacked data for the details of celebrities living in London, before trying to access their bank information.”
- “This is real crime and as we've seen today, it comes with real consequences.”
Broadcast Timeline
News broadcasts tracked for this story, in time order.