Owen Flowers, 18, and Thalha Jubair, 20, were each sentenced to five and a half years at Woolwich Crown Court on Thursday, 16 July 2026, for the 2024 hack of Transport for London.
The attack left 148 TfL systems inoperable and forced all 27,000 of the transport authority's employees into an office to get their passwords reset in person. Both the NCA and the CPS put TfL's losses and recovery costs at £29 million.
Both pleaded guilty on 22 June 2026, the day their trial was due to start. The charge was Section 3ZA of the Computer Misuse Act 1990, the Act's most serious, and they admitted it on the basis that they were reckless as to whether they caused or created a significant risk of serious damage to human welfare.
The CPS says Flowers and Jubair are believed to be the first hackers successfully prosecuted under Section 3ZA. The NCA counts the case as only the second prosecution of its kind. The two readings can sit together, one counting prosecutions brought under the section and the other counting those that ended in conviction, but neither agency explains the gap.
The NCA calls it the biggest cybercrime prosecution the UK courts have seen.
