Teenage loners who ran a £29million cyber-hacking spree from their bedrooms are jailed for five years - and could be extradited to the US

By REBECCA CAMBER, CRIME AND SECURITY EDITOR Published: 23:41, 16 July 2026 | Updated: 23:53, 16 July 2026 One of Britain's most notorious cyber hackers was jailed for five years on Thursday for a £29million attack on the transport network – and could now be extradited to the US. Thalha Jubair, 20, and his associate Owen Flowers, 18, took down Transport for London (TfL) in a four-day cyber attack in 2024 which threatened to cause £56billion of 'catastrophic damage'. The pair could have 'shut down TfL completely' but bosses managed to 'pull the plug' on its network before they did. Sentencing them each to five years and six months in jail at Woolwich Crown Court, Judge Mark Turner said: 'I'm satisfied your actions were motivated by selfish bravado, heedless of the severe consequences to others.' Now Jubair faces subsequent extradition to the US over even graver charges. He has been charged in New Jersey over allegations of extorting at least £87million through hacks on 47 American companies and organisations between 2022 and 2025. He and Flowers became notorious, attacking companies around the world. They were core members of the Scattered Spider network, which has been linked to attacks on Jaguar Land Rover, which cost an estimated £1.9billion, a £300million hack of M&S, attacks on Harrods, and one on the Co-op, which caused losses of £206million. Some $10million (£7.5million) was moved from Jubair's crypto wallets after he was released from custody in March last year and $200million worth of crypto had also moved through accounts belonging to him, a court hearing was told. Flowers held $7.1million in accounts he controlled, it was also claimed. It was the spending of funds which proved to be Jubair's undoing. He bought gift vouchers for a food delivery service using a cryptocurrency wallet which contained £27million he and fellow hackers had allegedly taken in ransom from major US companies. Owen Flowers, 18, was arrested at his grandmother's home in Walsall, West Midlands  Thalha Jubair, 20, was traced to his home in a 22-storey tower block in Tower Hamlets, east London Jubair and his co-defendant carried out a cyber attack on Transport for London (TfL) Flowers and Jubair hacked TfL's online network, resulting in a £39 million los, prosecutors have said The mistake led the FBI right to his door – by tracing the takeaways and discovering that he was a 17-year-old autistic loner who lived with his parents in a 22-storey tower block in Tower Hamlets, east London. Meanwhile, the UK's National Crime Agency (NCA) launched its biggest ever cyber-crime investigation over the TfL attack, arresting Flowers in 2024. He carried out attacks from his bedroom at his grandmother's home in Walsall, West Midlands. Jubair had begun hacking aged 13 after being recruited on gaming platforms and, by 15, he had managed to infiltrate the City of London Police's systems. His lawyer Paul Keleher said he became the 'Artful Dodger', recruiting other young hackers. His bedroom became headquarters of a cyber criminal network while he studied for his GCSEs. In 2023, Jubair was found guilty of 22 offences, including blackmail, fraud and stalking, and was given an 18-month youth rehabilitation order. But he continued to target major corporations. Court files allege that Jubair hacked the US federal court system by impersonating a judge to gain entry to their email account. In 2024, Jubair vowed to 'f*** the railways' and 'nuk[e] access' after compromising the account of an employee to hack into TfL's systems. The breach disrupted TfL's services for months, affecting the personal data of millions of people and leaving 28,000 TfL employees needing to reset their passwords. Paul Foster, head of the NCA's National Cyber Crime Unit, said: 'This is the largest cyber-crime prosecution ever brought before the UK courts and the culmination of nearly two years of painstaking work by the NCA, CPS and our policing partners. 'Scattered Spider has been the most significant cyber-crime threat to the UK in recent years. Through this investigation, we have severely disrupted that threat and brought key offenders to justice.'