.jpeg?width=1200)
Allow Exco Player content
This content is provided by Exco Player and may use cookies or similar technologies. Please click 'Allow and Continue' below to load the content.
Thalha Jubair was described as a “modern day Oliver Twist” by his defence team.
The 20-year-old from east London was still a teenager when he and his partner in crime, Owen Flowers, launched a nine-day hack of Transport for London’s online network on August 29, 2024.
Using stolen employee credentials obtained on the dark web, the pair exported about six million lines of data and compromised the accounts of 28,000 employees, prosecutors told Woolwich Crown Court.
The cyber attack crippled the capital’s transport operator, costing £29 million to repair and an estimated further £10 million in lost revenue.
It raised an obvious question: how had two teenagers — one raised in a tower block in Tower Hamlets, the other living with his grandmother in the West Midlands — inflicted such damage?
Flowers and Jubair were members of the notorious hacking group Scattered Spider, which was last year linked to cyber attacks on M&S, Co-op and Jaguar Land Rover.
Read More
Last September, detectives and investigators from the National Crime Agency (NCA) raided the two-bedroom flat on the third floor of a 21-storey council block in Bow, where Jubair lived with his parents, after he made a simple mistake: ordering a takeaway.
He paid for the meal using food delivery gift vouchers purchased with a cryptocurrency wallet hosted on the same server that he and fellow hackers allegedly used to store tens of millions of dollars’ worth of Bitcoin paid in ransoms by major US companies.
He had also topped up an online gaming account using funds from the same server.
The digital trail led detectives to his address.
Owen Flowers, 18, and Thalha Jubair, 20, conducted an “extremely serious hack” on TfL’s online network MPSWho is Thalha Jubair?
Jubair, who has autism spectrum disorder, is the only child of two carers who emigrated to Britain from Bangladesh.
He attended a local school in Bow and is understood to have developed an interest in computing from an early age.
During his sentencing this week, Woolwich Crown Court heard that he had spent almost his entire life online.
He was given a mobile phone at the age of four and a laptop at seven. By the age of nine he was writing computer scripts and, in his early teens, had attracted the attention of more experienced hackers, who identified him as having potential.
Jubair’s defence team argued that he was "groomed and exploited by much older criminals".
He was described as a "modern-day Oliver Twist" — a child targeted by criminals and groomed by older criminals.
The court heard that Jubair’s autism made socialising difficult and that he had been bullied, prompting him to seek validation online.
He attempted suicide twice and was referred to adolescent mental health services.
His defence argued that this combination of social isolation and poor mental health left him vulnerable to grooming by cyber criminals.
In targeting TfL, the defence said, Jubair had been driven largely by curiosity, spending hours searching for celebrity TfL accounts.
That account was challenged after the court heard that "tunnels" had been installed within TfL’s systems, allowing the pair to regain access even after they had been locked out.
Who is Owen Flowers?
Flowers was arrested at his grandmother's homeNCAThe younger of the pair, Flowers had a difficult upbringing, according to his defence team.
He had been known to children's services since he was young and had a disrupted childhood that led to him living with his grandmother in a three-bedroom home in Walsall.
Like Jubair, he had "no friends" outside of the online world, his defence argued.
As a young teenager he had been subject to a cease and desist notice issued by West Midlands Police prevent officers in October 2023 and was offered advice around computer misuse offences.
But he did not want to engage in any training, according to the National Crime Agency.
Flowers is immature and neurodivergent, he defence said, as they argued for “the court to impose the shortest term of imprisonment”.