Owen Flowers, an 18-year-old from Walsall, has been sentenced to five years and six months in prison for orchestrating a sophisticated cyber attack on Transport for London (TfL) that cost the public purse £29 million. The attack, which took place over four days in September 2024, involved hostile intrusions into TfL's network and systems, causing severe disruption and economic harm.
The Attack and Its Impact
Flowers, who lived with his grandmother and uncle in Broad Lane, Walsall, collaborated with Thalha Jubair, 20, from Tower Hamlets, East London. Together, they hacked into TfL's systems, forcing the transport authority to disconnect all computer connectivity to the internet to prevent further damage. Prosecutor Mark Fenhalls KC stated, "It was the only thing at that point that they could have done to remove the threat from the system and prevent a catastrophe." Had they succeeded in shutting down the transport network, the cost could have reached up to £56 billion.
The disruption affected the Dial-a-Ride booking service, concessionary travel cards, the digital payments channel, and the rollout of contactless ticketing. All 27,000 TfL staff were required to reset their passwords, and the hackers downloaded a significant amount of personal data from the Oyster card database.
Arrest and Further Crimes
When police stormed Flowers' home, they found his laptop in the process of hacking two US healthcare systems: SSM Health and Sutter Health. He was "literally caught in the act," the court heard. His timely arrest prevented substantive damage or data exfiltration from those systems. Flowers initially denied involvement, handing officers a prepared statement full of lies, but later confessed along with Jubair.
Flowers had been known to authorities; in October 2023, he received a cease and desist notice from West Midlands Police for making hoax calls to emergency services. He refused to engage with the Cyber Choices program, the cyber equivalent of the anti-terrorism Prevent initiative.
Motivation and Background
Defence barrister Adam Davis KC described Flowers as an "accomplished hacker" but "immature," motivated by "selfish bravado" and a desire for notoriety within the cyber criminal community. No financial demands were made during the TfL attack. Flowers had an unsettled childhood, with children's services involved from 2008, and experienced significant isolation. He struggled with social relationships and had no real friends until he began hacking.
While on remand, Flowers continued hacking from his cell, teaching others and studying law to prepare for his sentencing. Messages revealed he said, "bro i've been studying law on the side since i got arrested" and that he had "some weed debts to pay off."
Sentencing and International Cooperation
On July 16, 2025, Mr Justice Turner sentenced Flowers and Jubair to five years and six months each. He noted their young ages and neurodivergence but stated immediate custody was necessary. The judge said they were motivated by "selfish bravado heedless of the severe consequences to others." The pair were linked to the hacking group Scattered Spider, which has been connected to previous attacks on Marks & Spencer and Jaguar Land Rover.
The National Crime Agency (NCA) led the investigation with support from Europol, the Australian Federal Police, and the FBI. Brett Leatherman, FBI cyber division assistant director, said, "The announcement represents a significant step in holding accountable two members of Scattered Spider... The FBI commends the National Crime Agency for its exceptional work."
Flowers pleaded guilty to conspiracy to commit unauthorised acts in relation to a computer, causing or creating risk of serious damage, and two further charges related to hacking US healthcare systems. Jubair admitted conspiracy to commit unauthorised acts in relation to a computer.
