TfL hackers jailed over €45m breach exposing corporate cyber risks
Two men linked to a major cybercrime syndicate have been jailed for a devastating attack on London's transport network, highlighting the mounting financial toll of data breaches on European infrastructure and retailers.
A UK court has sentenced two men to prison for a 2024 hack on Transport for London that exposed the personal data of around seven million customers. Thalha Jubair, 20, and Owen Flowers, 18, were each handed five-and-a-half year sentences at Woolwich Crown Court.
The attack inflicted significant financial damage on the public transport operator, costing approximately £29 million (€34 million) in damages and a further £10 million (€11.7 million) in lost income. While train and bus services continued to operate, parts of TfL's systems remained offline for three months following the breach.
The teenagers gained access using employee credentials purchased from "russianmarket", a dark web marketplace, before convincing a helpdesk to reset a password. Prosecutor Mark Fenhalls told the court the pair effectively held "the keys to the kingdom", granting them control over the entire network. They spent 16 consecutive hours searching for celebrities' travel histories and attempting to access payment information.
The breach underscores the severe operational and financial vulnerabilities facing European corporations. Judge Mark Turner attributed the attack to "selfish bravado", but the method points to a systemic threat. Prosecutors linked both men to Scattered Spider, a cybercrime group responsible for a string of high-profile attacks on British retailers including Marks & Spencer and the Co-op.
The scale of the pair's illicit activities extended well beyond London's transport network. When officers raided Flowers's home during the TfL investigation, they discovered him actively hacking US-based healthcare providers Sutter Health and SSM Health Care Corporation. Jubair had a previous juvenile conviction for cyberattacks targeting US chipmaker Nvidia and had also admitted hacking the City of London Police.
Described by prosecutors as "experienced and talented" hackers who had been known to authorities for years, the two men represent a growing cohort of young cybercriminals capable of inflicting outsized economic damage. For European businesses, the £39 million (€45.7 million) toll on TfL serves as a stark reminder of the direct bottom-line impact of inadequate credential security.
