London Transport Hack: How a Simple Phone Call Caused Massive Disruption and a 5½‑Year Sentence

Background of the Defendants

Two young hackers, Owen Flowers (19) and Thalha Jubair (20), were members of the English‑speaking Scattered Spider group, previously responsible for attacks on major US casino operators.

How They Breached TfL

From 31 August to 3 September 2024 the duo targeted Transport for London (TfL). Their method was not a sophisticated software exploit but a social‑engineering phone call. An accomplice pretended to be a TfL employee, called the IT help‑desk, claimed to have forgotten a password, and convinced staff to reset it. The reset granted the attackers "king‑level" privileges, allowing unrestricted access.

Consequences of the Intrusion

Personal data of 7–10 million users was exposed.

Student Oyster card issuance was halted for months.

The Dial‑a‑Ride service for disabled passengers became inoperable.

TfL’s app and website stopped showing subway arrival times.

2.7 × 10⁴ employees were forced back to the office to change passwords after the network was disconnected.

The direct cost to repair systems was about £29 million, with an additional £10 million in lost revenue, totaling roughly £39 million in actual losses. Authorities estimated that if the attack had succeeded fully, economic damage could have reached £56 billion.

Court Proceedings and Unusual Behaviors

While incarcerated, Flowers used a smuggled phone to livestream the attack on Telegram and discussed potential further hacks of UK justice systems. Jubair, who had a history of 22 prior offenses, ordered food delivery to his home using a cryptocurrency‑linked voucher, which led police directly to him. Both defendants were diagnosed with autism; Jubair also had depression. The judge criticized Flowers for attempting to hack the UK Ministry of Justice from prison.

Sentencing and Rationale

Each received a sentence of 5 years 6 months under the UK Computer Misuse Act Section 3ZA, which can carry life imprisonment for attacks on critical infrastructure. The relatively light term was attributed to early guilty pleas, the defendants' young ages, mental‑health considerations, the UK’s refusal to extradite them to the US, and the fact that TfL’s rapid network isolation limited the damage, leading the court to treat the case as an attempted rather than completed offense.

Broader Implications

Security experts say the verdict does not sufficiently deter future cybercrime, noting the massive potential losses. The case underscores that social‑engineering attacks—often as simple as a phone call—remain the weakest link in enterprise security, outpacing even advanced technical vulnerabilities.