Two men have been sentenced for a cyber attack on Transport for London (TfL) which cost tens of millions of pounds in losses and caused disruption for thousands of customers.
20-year-old Thalha Jubair and 18-year-old Owen Flowers infiltrated the network between 31 August and 3 September 2024.
They both pleaded guilty last month after being arrested in on 16 September last year.
This is only the second criminal prosecution of its kind in the UK under the Computer Misuse Act (CMA).
The pair were both leading members of the online criminal collective known as Scattered Spider.
The National Crime Agency (NCA) believes that their prosecutions have effectively halted the groups criminal activity and Microsoft have confirmed that the arrests materially degraded the group's ability to continue conducting cybercriminal operations.
A number of services were disrupted by the attack, including the Dial-a-Ride booking service, which provides transport to vulnerable Londoners, the provision of concessionary travel cards, the digital payments channel and the extension of contactless ticketing.
All 27,000 of TfL’s employees had to attend a TfL office for a password reset and 148 systems were rendered inoperable, including critical ones that required significant manual workarounds and delays. It is estimated to have cost TfL £29 million. Had the attack been successful in shutting down the transport network, it could have cost the economy £56 billion.
Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said: “This is the largest cyber crime prosecution ever brought before the UK courts and the culmination of nearly two years of painstaking work by the NCA, CPS and our policing partners.
“Scattered Spider has been the most significant cybercrime threat to the UK in recent years. Through this investigation, we have severely disrupted that threat and brought key offenders to justice.
“The attack on Transport for London caused significant financial harm and disruption to a vital part of the UK’s critical infrastructure. These convictions would likely not have been possible had Transport for London not engaged with law enforcement early, so I would urge any other organisation to please do the same in such circumstances.
“We will continue working with partners in the UK and overseas to identify offenders and bring them to justice.”
Commander Ollie Shaw, at the City of London Police said: "Cyber crime continues to evolve rapidly and presents a significant threat to individuals, businesses and our national security. Through new proposed Cyber Crime Risk Orders (CCROs) the police and law enforcement would be equipped with an important additional tool to help prevent harm, disrupt criminal activity and protect the public.
“These proposals are designed to be flexible, so that courts can set restrictions based on the level of risk an individual poses, rather than using the same approach for everyone. This could include limits on devices, online services or technologies that are often used to commit cyber crime, creating a type of "digital prison" for cyber offenders.
“The aim is not just to punish offenders, but also to help them rebuild their lives and use technology safely and legally – as the vast majority of people already do. The measures would be overseen by the courts and reviewed regularly to make sure they remain fair and proportionate. As more crime is enabled by digital technology, it’s really important that policing has modern powers to prevent offenders from causing further harm."
