British-Bangladeshi hacker, accomplice jailed over London cyberattack that cost nearly $40m

Two British hackers behind a 2024 cyberattack on London's public transport body, which cost £29 ‌million ($39.16 million) to fix, were each sentenced yesterday (16 July) to 5 to 1/2 years in jail.

British-Bangladeshi Thalha Jubair, 20, and Owen Flowers, 18, pleaded guilty last month to hacking Transport for London (TfL), which had been blamed on a hacking collective.

Jubair and Flowers ​hacked TfL between 31 August and 3 September 2024, working up to 16 hours a ​day—Jubair from his parents' flat in east London and Flowers in his grandmother's ⁠home in central England—after gaining access to TfL systems.

Jubair broadcast a livestream of the hack, which ​Flowers watched, with the video found on Flowers' laptop providing key evidence, prosecutor Mark Fenhalls said.

The pair ​could have "shut down TfL completely," and the attack was stopped only when TfL pulled the plug on their computer systems, Fenhalls said. The damage caused took six months to fix.

Flowers also admitted to conspiring with others to hack two not-for-profit ​health systems in the United States just days after targeting TfL, with those attacks stopping "only because he ​was arrested and literally caught in the act," Fenhalls added.

Flowers continued to attempt hacks from prison after his arrest, ‌Fenhalls ⁠said, with devices showing search terms and attempts to access domains linked to the Crown Prosecution Service and the prison he was being held in.

Sentencing both Jubair and Flowers to 5-1/2 years in prison, Judge Mark Turner said he accepted they were "primarily motivated by selfish bravado."

ATTACK LINKED TO 'SCATTERED SPIDER'

British authorities have previously ​said a hacking collective ​known as Scattered Spider ⁠was responsible for the attack on TfL, with multiple reports also tying the group to an attack on retailer Marks & Spencer.

Prosecutors said on Wednesday it was a ​term coined by a cybersecurity firm and that Scattered Spider was considered ​more a pattern ⁠of behavior than a defined group, although Jubair and Flowers said they had links with it.

Jubair and Flowers were 18 and 17 when they targeted TfL, but, Fenhalls said, they were already experienced hackers, "highly skilled ⁠with computers ​and capable of wreaking havoc."

Jubair was convicted of hacking ​and blackmailing chipmaker Nvidia as part of the Lapsus$ hacking group and was also sentenced for stalking two young women, including "swatting" one ​by trying to send armed police to her home.