Hackers jailed over £29m TfL cyber attack that hit 10m customers 2026

Key Points

• Two men, Thalha Jubair (20) and Owen Flowers (18), were sentenced to five and a half years each at Woolwich Crown Court for conspiring to carry out an unauthorized cyber attack on Transport for London (TfL).
• The attack took place between 31 August and early September 2024, when the pair were still teenagers.
• TfL described the hack as “aggressive” and “extremely serious”, forcing the operator to disable parts of its own systems to stop the breach.
• The incident affected around 10 million customers and disrupted some TfL services for up to three months in summer 2024.
• TfL estimated the financial impact at £29 million according to some outlets, while others cite £39 million.
• Customer data was compromised, including names, addresses, contact details and some banking information.
• The pair livestreamed parts of the attack, which prosecutors said showed “the keys to the kingdom” being handed to the public.
• Owen Flowers also admitted conspiring to launch cyber-attacks on US healthcare systems SSM Health and Sutter Health.
• The defendants changed their pleas to guilty on the day a week-long trial was set to begin at Woolwich Crown Court.
• Sentencing took place on 15 July 2026, with both men receiving identical sentences of five and a half years’ imprisonment.

UK (Liverpool standard) July 16, 2026 – According to court proceedings reported by the BBC, the cyber attack was carried out by Thalha Jubair, from East London, and Owen Flowers, from Wall in the West Midlands, when they were 17 and 15 years old respectively.

As reported by the BBC, TfL described the intrusion as an “aggressive” cyber attack that targeted its online network and could have caused “catastrophic damage” if not stopped.

Prosecutors told Woolwich Crown Court that the pair were members of a wider criminal hacking group, and that they had livestreamed parts of the attack, allowing viewers to see how they gained access to TfL’s systems.

The Crown Prosecution Service stated that Flowers also admitted conspiring to carry out cyber-attacks on American not-for-profit healthcare providers SSM Health and Sutter Health, though he was not sentenced for those offences in this case.

What happened during the 2024 TfL cyber attack?

As reported by the BBC, the attack began on 31 August 2024, when TfL first detected irregularities in its cyber security framework.

TfL later disclosed that “certain customer data” had been compromised, including personal identifiers such as names, addresses, contact information and some banking details.

According to the BBC, the breach affected around 10 million customers and led to disruption of some services for up to three months during summer 2024.

To limit the hackers’ access, TfL engineers temporarily disabled some operational areas, including:

• live tube arrival information on digital platforms,
• online journey history access,
• the ability to register Oyster cards or process some refunds, and
• certain internal systems used by staff.

TfL told passengers that tap-on–tap-off payments using Oyster and contactless cards still worked at stations and on buses, but some online functions were unavailable.

How much did the TfL cyber attack cost London?

Different media outlets have reported slightly different figures for the financial impact of the attack.

As reported by Metro and the London.gov.uk-aligned Local Democracy Reporting Service, the hack cost London’s transport network about £29 million.

By contrast, the BBC and Yahoo News have cited a figure of £39 million for the operator’s costs linked to the incident.

TfL has not published a single definitive breakdown in the sources available, but both figures reflect the scale of remediation, system restoration, customer communication and operational adjustments required after the breach.

What did the court say about the seriousness of the attack?

As reported by the Guardian, prosecutors described the livestreamed attack as handing over “the keys to the kingdom” to the public, highlighting how unusually open the pair were about their methods.

Woolwich Crown Court heard that the intrusion was “extremely serious” and could have caused “catastrophic damage” to TfL’s systems if not stopped.

The CPS stated that the defendants’ actions were not only damaging to TfL but also demonstrated a pattern of willingness to target critical infrastructure, given Flowers’ additional admission about planned attacks on US healthcare systems.

Both Jubair and Flowers pleaded guilty to conspiring to carry out unauthorised actions against TfL under the Computer Misuse Act, and on 15 July 2026 were each sentenced to five and a half years’ imprisonment.

How has the TfL cyber attack affected passengers and staff?

As reported by the BBC, the breach affected 10 million customers and disrupted some services for three months in summer 2024.

TfL told passengers that while core transport operations continued, several digital services were temporarily unavailable, including:

• live arrival information on TfL Go and the TfL website,
• access to online journey history,
• Oyster and contactless registration and some refund processes.

Some TfL staff were initially instructed to work remotely and subjected to identification checks, while a full IT reset was later completed for all employees.

TfL warned that many staff had restricted access to systems, which could lead to delays in responding to online inquiries and customer service requests.

What does this sentencing mean for cyber crime in the UK?

The sentences of five and a half years each for two defendants who were teenagers at the time of the attack underline the seriousness with which UK courts now treat large-scale cyber intrusions against critical infrastructure.

As reported by the CPS, the case was prosecuted under the Computer Misuse Act and highlighted the potential for severe penalties even for young offenders when the scale of harm is significant.

The livestreamed nature of the attack is likely to be seen by regulators and security professionals as a dangerous trend, where criminals seek not only to breach systems but also to publicise their methods in real time.

Background of the TfL cyber attack development

The Transport for London cyber attack emerged in late August 2024 as one of the largest breaches affecting a major UK public transport operator.

TfL first detected irregularities on 31 August 2024 and subsequently confirmed that customer data had been accessed, including personal and some financial information.

The incident forced TfL to take emergency measures such as pulling the plug on parts of its own online systems, disabling certain customer-facing services, and conducting a full IT reset for staff.

Legal proceedings began in 2025, with Thalha Jubair and Owen Flowers initially facing a week-long trial at Woolwich Crown Court. On the day the trial was set to start, both men changed their pleas to guilty, admitting to conspiring to carry out unauthorised actions against TfL under the Computer Misuse Act.

Their sentencing on 15 July 2026 concluded the highest-profile legal phase of the case, with both receiving identical sentences of five and a half years.

Prediction: how this development can affect London commuters and users of digital services

For London commuters, the most immediate effect of the sentencing is likely to be greater confidence that TfL and the Justice System are treating cyber threats seriously, which may reduce anxiety about future data breaches.

However, commuters may also face continued caution around digital services: TfL and other transport operators are likely to tighten access controls, introduce more verification steps, and possibly limit some online features in the short term to reduce risk.

Passengers who had their data compromised in 2024 should remain vigilant about potential fraud, as the attackers accessed names, addresses, contact details and some banking information.

For users of digital services across the UK, the case signals that large-scale cyber attacks on critical infrastructure can lead to multi-year prison sentences even for young offenders, which may encourage companies to invest more heavily in cyber security and incident response planning.

In the longer term, the livestreamed nature of this attack may prompt regulators to consider whether new rules are needed around the public broadcasting of cyber intrusion techniques, particularly when they target critical public services.