The 2024 TfL cyber attack was carried out by two young men who had already come to the attention of police years before the incident. Owen Flowers and Thalha Jubair admitted to their roles in the attack, which caused widespread disruption across Transport for London (TfL) services and exposed the personal data of millions of customers.
Authorities say both individuals had a long history of cybercrime despite multiple attempts to prevent further offending. The case has renewed concerns about how young cybercriminals are monitored and rehabilitated.
TfL Cyber Attack Disrupted Services and Exposed Customer Data
Owen Flowers, 18, from Walsall, and Thalha Jubair, 20, from east London, pleaded guilty to carrying out the cyber attack on Transport for London.
The breach disrupted TfL operations for months, compromised the personal information of millions of customers, and forced all 28,000 employees to reset their passwords in person.Investigators found that both men had been involved in cybercrime long before the TfL attack. Their history has raised questions about the effectiveness of current intervention programmes.
Owen Flowers Ignored Early Police Warnings
First Contact with Police
Flowers first came to the attention of police in October 2023 when he was just 16 years old. Officers warned him to stop engaging in cybercrime and issued a cease-and-desist notice.
Police did not refer him to the Cyber Choices programme, which helps steer young people away from cybercrime, because they were already investigating him and he refused to cooperate.
Connection to Scattered Spider
Despite the warning, Flowers later became involved with the cybercrime group Scattered Spider and eventually participated in the high-profile TfL cyber attack.
National Crime Agency Calls for Stronger Cybercrime Laws
Proposed Cyber Crime Risk Orders
The National Crime Agency (NCA) believes the case demonstrates the growing challenge of tackling highly skilled young cybercriminals.
Deputy Director Paul Foster has called for the introduction of Cyber Crime Risk Orders (CCROs), which would allow courts to impose restrictions on individuals considered at high risk of committing serious cyber offences before further attacks take place.
The proposed measures are intended to help prevent major cyber attacks before they occur. read more
Police Seized Millions in Cryptocurrency
Flowers was arrested in September 2024 during the investigation into the TfL cyber attack.
During searches of his home, officers recovered multiple electronic devices along with cryptocurrency reportedly worth millions of pounds.
Links to US Healthcare Cyber Attacks
Investigators also connected Flowers to cyber attacks targeting two US healthcare providers—SSM Health and Sutter Health.
He later admitted to offences linked to those attacks and is currently wanted by US authorities. After being released on bail, Flowers breached his bail conditions twice during 2025.
Thalha Jubair’s Long History of Cybercrime
Previous Links to Lapsus$
Jubair had also been known to police for years.
In 2023, while still under the age of 18, he received a Youth Rehabilitation Order for cyber offences linked to the hacking group Lapsus$, which targeted major companies including Nvidia and BT/EE.
Because he was a minor, his identity was not made public at the time.
Wanted in the United States
Jubair began committing cyber offences at the age of 14 and has accumulated multiple previous convictions.
US authorities also want him in connection with cybercrimes involving the alleged theft and extortion of approximately $87 million.
Both Flowers and Jubair are scheduled to be sentenced for the TfL cyber attack on 16 July. know more
Experts Say Better Deterrence Is Needed
Young Cybercriminals Often Ignore Consequences
Cybersecurity expert Professor Peter Sommer said the case highlights the need for stronger deterrents to prevent repeat cyber offenders.
According to Sommer, many young cybercriminals fail to understand the real-world impact of their actions on businesses, employees, and individual victims.
The court also heard that both Flowers and Jubair have autism, while Jubair has also been diagnosed with depression and a severe mood disorder.
