Two men who carried out a cyber-attack which crippled Transport For London (TfL) when they were teenagers have both been sentenced to five years and six months in prison.
Owen Flowers, 18, from Walsall, and Thalha Jubair, 20, from east London, pleaded guilty in June to carrying out the hack in 2024.
They were described as computer-obsessed loners who carried out the hack as part of the cyber crime collective known as Scattered Spider.
The cyber-attack disrupted TfL’s online services for months, stole the personal data of millions of people and left all 27,000 TfL employees needing to reset their passwords in person.
Woolwich Crown Court heard the criminals streamed their 16 hour long cyber-attack online.
The National Crime Agency (NCA) said the rise of young hackers in the UK as one of the biggest threats to the nation’s cyber security.
Flowers was 17 and Jubair was 18 when they hacked into the capital’s transport authority at 1700 on 31 August.
Telegram messages sent between the pair showed them boasting about gaining access to TfL’s database of people with Oyster cards.
The teens then searched the list for the personal details of London celebrities, before attempting to access banking details.
“Scattered Spider is creating webs on the London Underground,” Flowers would later joke – referring to the loosely coordinated group of young English-speaking hackers.
The group has been linked to dozens of other cyber-attacks including on retailers Marks and Spencer and the Co-op.
In the last two years young men and boys have been arrested for Scattered Spider hacks in the UK, US and Finland.