Teen hackers who orchestrated £29million TfL cyber attack from their bedrooms are jailed for five years and six months

By REBECCA CAMBER, CRIME AND SECURITY EDITOR Published: 11:53, 16 July 2026 | Updated: 11:59, 16 July 2026 Two teenagers who became Britain's biggest cyber hackers have been jailed for five years for a £29milllion attack on the London transport network after being caught out by a takeaway order. Thalha Jubair, 20, and Owen Flowers, 18, took down Transport for London (TfL) in a four-day cyber attack that threatened to cause £56billion of 'catastrophic damage', but TfL managed to 'pull the plug' on their network to stop the pair. Now it can be revealed how the duo became Britain's worst hackers, ransoming companies around the world for tens of millions of pounds, continuing to wreak havoc even behind bars. The prolific pair were core members of the notorious Scattered Spider network, which has been linked to attacks on Jaguar Land Rover costing an estimated £1.9billion, a £300million hack of M&S, attacks on Harrods and the Coop causing losses of £206million. Even after their capture as Flowers was on remand, he used a smuggled phone to try to hack into the Crown Prosecution Service, the Ministry of Justice, various government domains and even the prison he was being held in. Meanwhile, his accomplice Jubair is estimated to have handled £200 million in cryptocurrency from ransoming businesses since he became a hacker at the tender age of 13, US prosecutors believe. Ultimately it was the spending of that cash that was to prove his undoing after Jubair splashed out, not on fast cars or jewellery, but on food takeaways. He bought gift vouchers for a food delivery service using a cryptocurrency wallet containing £27million he and his fellow hackers had allegedly taken in ransom payments from major US companies. Thalha Jubair, pictured, was part of a hacking group called Scattered Spider and, along with Owen Flowers, has been jailed for a £39m cyberattack that paralysed the TfL network Pictured: Flowers. Alongside Jubair, they managed to cause chaos for Oyster card users across the capital The mistake led the FBI right to his door by tracing the takeaways, discovering that one of the most dangerous cyber hackers in Britain was a 17-year-old autistic loner living with his parents in a high-rise block next to a Met Police call handling centre in Tower Hamlets, East London. The National Crime Agency then launched their biggest ever cyber crime investigation into their activities. Today Mr Justice Turner told the 'reckless' pair: 'I'm satisfied your actions were motivated by selfish bravado, heedless of the severe consequences to others.' He sentenced Flowers to five years and six months, as he was only 17 at the time of offending and had no previous convictions. Jubair was handed the same sentence despite racking up 22 prior convictions for cyber crimes, with the judge remarking on his 'level of persistence undeterred by police intervention and court appearances.' Earlier, Jubair's lawyer Paul Keleher, KC, told Woolwich Crown Court that his client was a 'modern day Oliver Twist', groomed by criminals to hack companies from the age of 13. In a cautionary tale of an 'online upbringing', Jubair was given a smart phone at the age of four and he got his first laptop at six from his father who worked as a care worker and his mother worked with children who have special needs. By the age of nine Jubair was writing computer programmes, at 13 he had graduated to hacking after being recruited on gaming platforms like Roblox and by 15 he had managed to infiltrate the City of London Police systems. Mr Keleher said his client later graduated to becoming the 'Artful Dodger', recruiting other young hackers teaching them tricks. The friendless loner revelled in his growing reputation online after being bullied and isolated at school. His bedroom in a 22-storey tower block overlooking a park, became the unlikely headquarters of a millionaire cyber criminal while Jubair was still at school. He started off SIM-swapping when an individual's mobile phone number is redirected to a hacker, enabling authentication codes to be sent directly to criminals. In 2021, Jubair amassed 700 victims using this method in an attack on BT/EE. By the age of 15 he was part of a teenage hacking group described by prosecutors as 'online bandits', claiming tech giants such as Microsoft, Nvidia, Samsung, T-Mobile and Uber among their victims, stealing data and source code, including the unreleased Grand Theft Auto 6 from Rockstar. Despite being under police investigation, Jubair was more worried about his parents finding out, according to messages sent to other hackers. But in the event, he was arrested in his school uniform. In 2023 he was convicted of 22 offences including blackmail, fraud and stalking, receiving an 18-month youth rehabilitation order. But Jubair continued to target major corporations. US prosecutors have linked Jubair and his associates to at least $115m (£86m) in ransom payments, including from a major hack of Las Vegas casinos. Court documents allege that Jubair even hacked the US federal court system by contacting the help desk, impersonating the relevant judge to ask for a password reset, then gaining entry to the judge's email account. Court sketches of Flowers, left, and Jubair, right. Their scheme targeted key features of the TfL Go app and the TfL website In September 2024, Jubair vowed to 'f*** the railways' and 'nuk access' after compromising the account of a single employee to hack into TfL's systems. Although buses and tubes were kept running, the breach disrupted TfL services for months, affected the personal data of millions of people and left all 28,000 TfL employees needing to reset their passwords in person. The booking system for the Dial-a-Ride buses used by people with disabilities was shut down, and data on live tube times for apps such as TfL Go and Citymapper was taken offline. Jubair and Flowers hunted celebrity TfL users, but they were unable to get into credit card details. When police swooped just hours later, they caught Flowers in the act hacking two not-for-profit US healthcare companies from his bedroom in Walsall, where he lived with his grandmother. Even in a prison cell he continued to profit from his crimes, receiving £450,000 in Bitcoin which he planned to 'wash' for clean cryptocurrency to pay drug debts from smoking cannabis behind bars. Flowers boasted to other hackers that he would be out of prison soon: 'Bro I'll get 2 ish years for TfL. 'Would have done a year by trial. Go home straight away. Right now it's a section 3za (offence) which is 14 years max (in) prison, but cuz I was youth I won't get as long as.' He added: 'Bro, I've been studying law on the side since i got arrested. Studying the judges i might get.' But Mr Justice Turner remarked: 'There's no Fagin in this case, it's a Fagin-less crime.' Neither defendant showed any emotion as they were sentenced. This is a breaking news story. More to follow.