British hackers get 5.5-year sentences for TfL cyberattack

Two British hackers were each sentenced to five years and six months in prison on Thursday, July 16, 2026, for a sophisticated cyberattack on Transport for London (TfL) that caused widespread disruption and cost tens of millions of pounds. Thalha Jubair, 20, from Bow in east London, and Owen Flowers, 18, from Walsall, pleaded guilty last month to conspiracy charges under the Computer Misuse Act for the intrusion, which occurred between August 31 and September 3, 2024.

The attack gave the pair deep administrative access to TfL's internal systems, with prosecutors stating they held the "keys to the kingdom" and could have completely shut down the transport body. The intrusion was only halted when TfL was forced to disconnect its own systems. While London's tube and bus services continued to operate, the hack caused severe technical fallout. Live arrival information was disabled, Oyster and contactless payment systems were delayed, and applications for concessionary travel cards were suspended. The Dial-a-Ride service for disabled passengers was unable to process bookings. All of TfL's more than 27,000 employees were required to attend offices in person to reset their passwords,...