Teenage Hackers Owen Flowers and Thalha Jubair Known to Police Before TfL Cyber-Attack
Owen Flowers and Thalha Jubair, both 19, received prison sentences for their involvement in a 2022 cyber-attack that targeted Transport for London (TfL). Flowers, from south London, was sentenced to six years in a young offender institution, while Jubair, from north London, received an 18-month sentence. The pair admitted to Computer Misuse Act offences and fraud.
Reports confirm that police were aware of both individuals’ activities years before the TfL breach. Flowers, operating under various online pseudonyms, including 'Vex' and 'Owen.g', was identified in intelligence reports from 2017. He was a member of 'The Breached' hacking collective, which conducted credential stuffing attacks using stolen login data. This group was linked to breaches of several UK companies, accumulating a database of over 100 million username and password combinations.
Jubair, known online as 'Incu', first attracted police attention in 2018 when he provided an old BT Home Hub modem to a Metropolitan Police officer. This device, configured for denial of service (DoS) attacks, prompted further investigation. Evidence presented during the sentencing detailed Jubair's engagement with an online community dedicated to exploiting vulnerabilities in telecommunication networks, specifically to obtain free internet and disrupt services.
The cyber-attack on TfL resulted in significant financial and operational disruption, with the transport authority incurring considerable expenses to mitigate the damage and enhance its security infrastructure.
