UK hackers jailed for London transport cyberattack which cost nearly $40 million
Details of the Cyberattack and Sentencing
By Sam Tobin
Overview of the Attack
LONDON, July 16 (Reuters) - Two British hackers behind a 2024 cyberattack on London's public transport body which cost £29 million ($39.16 million) to fix were each sentenced on Thursday to 5-1/2 years in jail.
Thalha Jubair, 20, and Owen Flowers, 18, pleaded guilty last month to hacking Transport for London (TfL), which had been blamed on hacking collective "Scattered Spider".
Execution of the Hack
Jubair and Flowers hacked TfL between August 31 and September 3, 2024, working up to 16 hours a day – Jubair from his parents' flat in east London, Flowers in his grandmother's home in central England – after gaining access to TfL systems.
Jubair broadcast a livestream of the hack which Flowers watched, with the video found on Flowers' laptop providing key evidence, prosecutor Mark Fenhalls said.
Impact and Prevention
The pair could have "shut down TfL completely" and the attack was stopped only when TfL pulled the plug on their computer systems, Fenhalls said. The damage caused took six months to fix.
Further Criminal Activities
Additional Hacks
Flowers also admitted conspiring with others to hack two not-for-profit health systems in the United States just days after targeting TfL, with those attacks stopping "only because he was arrested and literally caught in the act", Fenhalls added.
Continued Offenses from Prison
Flowers continued to attempt hacks from prison after his arrest, Fenhalls said, with devices showing search terms and attempts to access domains linked to the Crown Prosecution Service and the prison he was being held in.
Sentencing and Motivation
Judge's Statement
Sentencing both Jubair and Flowers to 5-1/2 years in prison, Judge Mark Turner said he accepted they were "primarily motivated by selfish bravado".
Background and Group Involvement
Attack Linked to 'Scattered Spider'
ATTACK LINKED TO 'SCATTERED SPIDER'
British authorities have previously said a hacking collective known as Scattered Spider was responsible for the attack on TfL, with multiple reports also tying the group to an attack on retailer Marks & Spencer.
Nature of the Group
Prosecutors said on Wednesday it was a term coined by a cybersecurity firm and that Scattered Spider was considered more a pattern of behaviour than a defined group although Jubair and Flowers said they had links with it.
Previous Offenses
Jubair and Flowers were 18 and 17 when they targeted TfL but, Fenhalls said, they were already experienced hackers, "highly skilled with computers and capable of wreaking havoc".
Jubair was convicted in 2023 of hacking and blackmailing chipmaker Nvidia as part of the Lapsus$ hacking group and was also sentenced for stalking two young women, including "swatting" one by trying to send armed police to her home.
Additional Information
($1 = 0.7406 pounds)
(Editing by William James and Timothy Heritage)
