The two teenage cybercriminals, Thalha Jubair, 19, and Owen Flowers, 18, who were recently sentenced to five years and six months imprisonment for a cyber-attack on Transport for London (TfL) are only tip of a huge iceberg of youthful cybercriminals. The attack cost the organizations £29 million and exposed the data of 7 million commuters during a four-day cyber-attack in 2024 which threatened to cause £56 billion of 'catastrophic damage', had TfL not managed to halt the attack.
Jubair also faces extradition to the US for more serious allegations of extorting at least £87million through hacks on 47 American companies and organisations between 2022 and 2025. As reported by cyberbriefdaily.com in March, teenage hackers like Jubair and Flowers working from their bedrooms are now a more serious threat than highly organized cybercriminals operating out of countries like Russia.
Jubair and Flowers are believed to be members of the Scattered Spider network, which has been linked to attacks on Jaguar Land Rover, which cost an estimated £1.9billion, a £300million hack of M&S, attacks on Harrods, and one on the Co-op, which caused losses of £206million.
But to see Scattered Spider as a highly-organized criminal gang is incorrect. It is an extremely loosely affiliated and sprawling network of teenage loners in the UK and the US who sometimes also refer to themselves as "The Community" or "The Com" for short. Like Jubair and Flowers, they tend to be slightly autistic teenagers working from their bedrooms and mostly still living in the family home who have learned their hacking skills in the gaming world.
A short step from gaming into cybercrime
The step from gaming into cybercrime is a short one. Jubair's barrister, Paul Keleher KC, told Woolwich Crown Court, where Jubair and Flowers were tried, that, by the age of 13, Jubair had been introduced to hacking by older criminals online "who recognised his potential". Keheler added that Jubair was "like a 21st-century Oliver Twist…If you can find a child like Jubair, you can use his nimble skills for hacking for profit."
From a psychological viewpoint, many teenage hackers see cybercrime as an extension of computer gaming and often seem to have little use for the millions of pounds they have defrauded or stolen online. Far from living a suspiciously luxury lifestyle of private yachts and pretty girls, Jubair was rumbled buying gift vouchers for a food delivery service using a cryptocurrency wallet which contained £27million he and fellow hackers had allegedly taken in ransom from major US companies.
But their frequently amateurish approach to a criminal career does not make teenage hackers any less of a threat. Typically, Jubair and Flowers' technical knowledge and English-speaking skills enabled them to trick TfL's IT helpdesk into resetting the passwords for the organization's chief information security officer. This form of attack is one widely favoured by teenage hackers on both sides of the Atlantic and can bypass the most strongest cybersecurity defences.
At the time of going to press, all company executives can do is pray that their organization will not be the next to be breached by lonely teenagers amusing themselves in their bedrooms.