Two teenage hackers responsible for a crippling cyber-attack on Transport For London (TfL) have been sentenced to five years and six months in prison. Owen Flowers, 18, and Thalha Jubair, 20, pleaded guilty to carrying out the hack in 2024, an event they live-streamed. Described as "computer-obsessed loners," they were part of the cyber-crime collective known as Scattered Spider.

During the 16-hour attack, Flowers (then 17) and Jubair (then 18) gained access to TfL's Oyster card database, boasting about it in Telegram messages. They sought personal details of celebrities and attempted to access banking information. The hack disrupted services, including Dial-a-ride, and cost TfL approximately £29 million. Both individuals have autism and gained access by impersonating an employee and tricking a help desk worker into resetting a password.

The National Crime Agency (NCA) highlighted the growing threat of young hackers in the UK. Flowers was also arrested while hacking US healthcare providers, with messages suggesting a callous disregard for patient lives. Jubair has a history of cybercrime, previously receiving a Youth Rehabilitation Order for hacking with the Lapsus$ group and is wanted in the US for alleged ransoms totaling $115 million.