The teenage millionaire hacker from Tower Hamlets who took down TfL

SubscribeSign in

The teenage millionaire hacker from Tower Hamlets who took down TfL<br>Traced through his takeaway order • Began playing Roblox • Allegedly handled £200m in Crypto • Based in his family flat near Bow Road station • One of the county's leading hackers

Polly Smythe, Jim Waterson, and Cormac Kehoe<br>Jul 08, 2026

40

18

Share

Illustration by Carly A-F for London Centric<br>It was the takeaway order to his family’s Tower Hamlets flat that proved to be Thalha Jubair’s undoing.<br>Last month the young Londoner pleaded guilty to taking down Transport for London’s computer systems in one of the worst cyberattacks in British history, an event which brought months of chaos to the capital’s transport network in late 2024.<br>Jubair thought he had covered his tracks through an elaborate system of amnesiac operating systems and virtual private networks. These not only allowed him to cause mass chaos in his home city of London but also allegedly enabled him to extort tens of millions of dollars in ransom payments from US companies.<br>Then he got hungry.<br>According to US prosecutors, the then-teenage Jubair made the mistake of deciding to order a takeaway. To do this, he bought gift vouchers for an unnamed food delivery service using a cryptocurrency wallet. This wallet hosted on the same server he and his fellow hackers allegedly used to store tens of millions of dollars worth of Bitcoin they’d taken in ransoms paid by major US companies.<br>Jubair then had the takeaways delivered to the flat where he lived with his parents, which is located in a high-rise block next to a Met Police call handling centre near Bow Road tube station in east London.<br>This was one of the clues which led to Jubair’s arrest last September, after a major investigation by the National Crime Agency, City of London Police, and the FBI. He was charged with committing unauthorised acts against TfL under the Computer Misuse Act, causing at least £39m in damage to TfL and months of disruption to the capital’s transport network. London Centric was in Woolwich Crown Court last month as the unassuming 20-year-old, who appeared awkward in glasses and a badly fitting grey suit, unexpectedly changed his plea to guilty at the last minute, alongside his Walsall-based co-defendant Owen Flowers.

Flowers (left) and Jubair (right) in Woolwich Crown Court last month.<br>So who is the TfL hacker? By attending court appearances, reviewing Telegram messages, and interviewing cybersecurity experts, London Centric has pieced together Jubair’s journey from a Roblox-playing east London child to a criminal mastermind who allegedly extorted tens of millions of pounds from his bedroom as part of the Scattered Spider cybergang.<br>His is the story of a very modern London adolescence.

The flight risk who took down a transport system<br>It was by compromising the account of a single employee that Jubair was able to hack into TfL’s systems in late August 2024, catastrophically damaging the transport authority’s ability to manage its own systems. At an early court hearing last September, the prosecutor said that the “ultimate objective of the attack was to install ransomware”.<br>Although buses and tubes were kept running, one TfL executive described the behind-the-scenes situation to London Centric as “an utter shitshow”, with hundreds of thousands of holders of discount travel cards affected.<br>The booking system for the Dial-a-Ride buses used by people with disabilities was shut down, and data on live tube times for apps such as TfL Go and Citymapper was taken offline.

The block of flats where Jubair ran his hacking operation.<br>Hundreds of thousands of Londoners were overcharged for using the network, and many of the capital’s teenagers were unable to access free travel, leaving some without the means to get to work or college. Sadiq Khan later told London Centric that some passengers would never be refunded.<br>TfL commissioner Andy Lord described the incident as a “highly sophisticated” cyber attack that could have been much worse. Staff at TfL’s HQ were unable to log on to the IT network, WiFi was taken down, and office-based staff were sent to work from home for the whole of September. When they returned, every TfL staff member had to travel into the office to have their login details reset. City Hall had just outsourced its IT to TfL meaning everyone from the mayor downwards had their work systems affected. Projects ranging from the extension of the contactless payment scheme to commuter stations to the rebranding of the London Overground lines were delayed.<br>Flowers, the teenager from Walsall, was arrested soon after. But it took another year for Jubair, who was portrayed in US court documents as a mastermind of the group, to be charged. We now know that the incident, which cost TfL £39m, and in which 10 million people’s data was stolen, was in part orchestrated from the bedroom of Jubair’s east London flat.<br>Paul...