Two men who live-streamed a cyber-attack on Transport For London (TfL) have both been sentenced to five years and six months in prison.

Owen Flowers, 18, and Thalha Jubair, 20, both pleaded guilty to carrying out the hack in 2024. The attack disrupted TfL's online services for months, leaving all 27,000 members of staff needing to reset their login information and stealing the personal data of millions of customers - all to the tune of a £39m cost.

Flowers and Jubair were described in court as 'computer-obsessed loners' who carried out the attack as part of a cyber crime collective known as Scattered Spider. The 16-hour long hack was also live-streamed by the assailants.

Telegram messages sent between the pair showed them boasting over gaining access to TfL's database of Oyster card users. The then-teenagers then proceeded to search the list for the personal details of notable celebrities, before attempting to access their banking details.

National Crime Agency response

The National Crime Agency (NCA) said the rise in number of young hackers in the UK was one of the biggest threats to the nation's cyber security today. The Scattered Spider group has been linked to dozens of cyber-attacks in recent years, including on retailers Marks & Spencer and Co-op.

In the last two years, arrests have been made on young hackers in the UK, US and Finland.

NCA deputy director Paul Foster, head of its National Cyber Crime Unit, said: "The online world can expose young people to harmful influences and criminal communities far beyond their front door. Parents, carers, educators, technology companies and law enforcement, the whole of society, we all have a role to play in helping to keep young people safe online."