Two young men have been jailed for five years and six months each over a cyber attack on Transport for London in 2024, in a case that investigators have described as the largest and most complex cyber crime investigation ever undertaken in the country. Owen Flowers and Thala Jabair were sentenced at Woolwich Crown Court for offences under the Computer Misuse Act, closing one chapter of an inquiry that authorities said was without precedent in its scale and reach.
The attack on TfL was estimated to have cost the transport authority around 29 million pounds. Officials were careful to stress that the pair did not steal money from TfL. Rather, the 29 million pound figure reflected the cost of repairing the damage they caused, a clean-up that also forced around 27,000 employees to come into the office and reset their passwords after the breach was discovered.
During the intrusion, the court heard, the attackers were able to exfiltrate a large quantity of personal data concerning the owners of Oyster cards. They gained access to TfL's systems and, in what officers described as a sophisticated and aggressive attack, built tunnels within the network so that they could return to it whenever they chose. According to those involved in the case, the pair were inside TfL's systems for around nine hours before anyone noticed anything was wrong.
The judge said Flowers had been broadcasting the progress of his hacking to a small audience of like-minded enthusiasts, and that much of the evidence against him came from videos found on his own computer when he was arrested. He had also embarked on two further malign projects, breaking into non-profit health systems in the United States, named in court as SSM Health and Sutter Health, though he was caught in the act at his home before he could cause substantive damage or remove sensitive data.
In passing sentence, the judge weighed the young men's ages and personal histories against the seriousness of what they had done. Flowers had recently turned 17 at the time of the offence and was described by his defence as immature, with the court taking into account his neurodivergence and what was said to be a very unsettled childhood and adolescence. The judge noted that police had visited Flowers in October 2023 to serve a cease-and-desist notice over hoax calls to emergency services, an intervention he declined to engage with.
For Flowers, the judge set a sentence of four years and eight months on the lead count, with additional terms for the intrusions into the American health systems ordered to run consecutively but reduced for totality, producing an overall sentence of five years and six months. His co-defendant, Jabair, who was slightly older, lacked the mitigation of having no previous convictions and had committed the offence while subject to an existing youth rehabilitation order, factors the judge treated as seriously aggravating.
Jabair's lawyers had argued in mitigation that he had simply wanted to rummage around inside TfL's networks, and compared him to Oliver Twist, portraying him as a young man who had been groomed and exploited by older criminals. The judge accepted elements of that account but concluded that both defendants had fully understood the serious criminality of their actions, and that the offences were so grave that there was no alternative to a custodial sentence. Jabair too was jailed for five years and six months.
Investigators said the two were part of Scattered Spider, a criminal group blamed for some of the most serious and damaging cyber attacks affecting the United Kingdom and countries around the world. The National Crime Agency, which led the inquiry with international partners, called it the largest and most complex cyber crime investigation it had ever carried out and the largest criminal prosecution of cyber offenders in British history. Both men will have to serve at least half of their sentences before they can be considered for release.