Two Hackers Sentenced to Prison for Attack on London Transit System

Two young hackers, Owen Flowers (age 18) and Thalha Jubair (age 20), were each sentenced to five and a half years in prison on July 16, 2026, for their role in a 2024 cyberattack on Transport for London (TfL). The attack left 148 computer systems inoperable and forced all 27,000 TfL employees to visit offices in person to reset their passwords. The court convicted them at Woolwich Crown Court, and both the NCA and CPS documented the extensive damage and recovery costs to the transport authority.

This attack affected London's public transportation system, which millions of people rely on daily.

While the article doesn't specify whether customer data was compromised, the disruption to systems could have affected payment processing, journey planning, and other services that riders depend on. Anyone who uses Transport for London services like the Tube, buses, or trains was potentially impacted by service disruptions during and after the attack.

If you use Transport for London services, here's what you should do:

1. If you have an online account with TfL for Oyster cards or contactless payment, change your password if you haven't done so since

3. Review your payment card statements for any unauthorized charges related to transit payments.

4. Enable two-factor authentication on your TfL account if this option is available. This case is important because it demonstrates that young people who commit cybercrimes face serious legal consequences. Both attackers were teenagers or in their early twenties when prosecuted. It's a reminder for parents to talk with children and teens about the serious legal and personal consequences of hacking, even if it seems like a game or challenge online. Cybercrimes are real crimes with real victims and real prison sentences.