A four-day hack cost London's public transport system £29 million. Attackers got in on August 31, 2024, and stayed active until September 3. London's transit agency cut every remote connection and took its computer systems off the internet to stop them.
The August 31 attack left 148 computer systems unusable. Attackers also downloaded personal data about Oyster card users. Some online travel services remained unavailable until November or December, even though Transport for London kept its buses and trains moving.
National Crime Agency TfL report, Official sentencing remarks
Four days inside TfL
Thalha Jubair and Owen Flowers carried out the attack with other people whom the court has not identified. Flowers recorded videos that showed Jubair inside TfL's systems. Flowers also streamed the attack's progress to a small online audience.
The court record says Jubair and Flowers downloaded a large amount of personal data about Oyster card owners. TfL stopped the break-in by blocking remote access and disconnecting its systems from the internet.
Jubair and Flowers pleaded guilty in June 2026. On July 16, a judge sent each man to prison for five years and six months.
Passengers waited for months
The August 31 attack stopped new applications for children's travel cards. Some passengers could not check trip histories, fix incomplete journeys or claim refunds for delays online. Dial-a-Ride's booking service, which carries disabled passengers, was disrupted too.
All 27,000 TfL employees had to visit an office to reset their passwords. Travel-card applications began reopening in early November 2024, more than two months after the attack. All four Oyster photocard programs were taking applications by the end of November.
TfL's annual report says trip histories returned in December 2024. Passengers could then fix incomplete trips and claim delay refunds online again.
The bill reached £29 million
TfL kept its buses and trains moving, but that did not make the attack small. The outages inconvenienced thousands of customers, and all 27,000 TfL employees had to reset a password in person. A four-day break-in left a £29 million bill without stopping the transport network.
