Show more Two Teenagers Just Got Locked Up For Hacking London's Entire Transit System

The two people British authorities say caused tens of millions of pounds in damage and knocked out London's transit system for weeks weren't shadowy state hackers or organized crime veterans. They were 18 and 20 years old.

Owen Flowers and Thalha Jubair pleaded guilty earlier this year to hacking Transport for London back in 2024, and on Thursday, they got sentenced to five years and six months each. UK police are now saying their arrest has "severely" damaged the operations of Scattered Spider, one of the more notorious hacking groups out there.

What they actually did

Back in summer 2024, TfL, the government body that runs London's public transit, got hit hard. The attack knocked out major parts of the system's infrastructure, including the ticketing system and the real-time train arrival info people rely on to figure out when their trains are actually showing up. This wasn't a quick outage either. The disruptions dragged on for weeks.

Authorities say the damage amounted to around £29 million, roughly $47 million. And it wasn't just surface-level access. According to The Guardian, Flowers and Jubair had gotten deep enough into TfL's systems that they basically held "the keys to the kingdom" they could have shut the entire operation down completely if they'd wanted to.

They weren't caught right away either. The arrests didn't happen until about a year after the attack. And Jubair specifically wasn't just linked to TfL the FBI accused him of being connected to attacks on more than 120 different companies, using social engineering tactics rather than pure technical exploits.

Why "just two guys" managed this much damage

This is the part that's genuinely worth sitting with. Groups like Scattered Spider don't operate like the popular image of hacking someone in a hoodie cracking encryption in a dark room. Their whole approach leans on social engineering: tricking actual employees into giving up access, rather than brute-forcing their way through firewalls and code.

That's a much harder thing to defend against. You can patch software. You can't really patch a person into never falling for a convincing phone call or a well-crafted phishing message. And it turns out you don't need a government-level budget or a sophisticated criminal syndicate to pull this off you just need to be smart, patient, and good at manipulating people, which teenagers motivated by money and reputation among their peers have turned out to be disturbingly capable of.

Scattered Spider's track record backs that up. This same group's been linked to attacks on casino giant MGM, airline WestJet, and cybersecurity firm Okta — and that Okta breach in particular gave attackers a way into a bunch of Okta's own customers, since Okta's whole business is managing access and identity for other companies.

Does locking up two people actually stop the group?

That's the trickier question. Groups like this tend to be loose and amorphous rather than a fixed organization with a clear hierarchy. Members come and go, and the group itself can essentially rebrand under a new name if it needs to. So arresting two specific people doesn't necessarily mean the underlying network or the tactics disappear with them.

Still, British authorities are treating this as a genuinely significant win. Paul Foster, who heads the UK National Crime Agency's National Cyber Crime Unit, put it plainly: "Scattered Spider has been the most significant cybercrime threat to the U.K. in recent years. Through this investigation, we have severely disrupted that threat and brought key offenders to justice."

Whether "severely disrupted" turns into "actually stopped" is going to depend on how central Flowers and Jubair actually were to the group's operations versus how easily replaceable they turn out to be. Given how young, decentralized, and reputation-driven these groups tend to be, there's a real chance someone else just steps into the gap.

But for now, two people who caused $47 million in damage to a city's entire transit system, and were allegedly connected to attacks on 120+ other companies, are heading to prison for over five years each. That's a real consequence, even if the broader threat these groups represent isn't going away anytime soon.