Thalha Jubair, 20, and Owen Flowers, 18, pleaded guilty in June to hacking Transport for London (TfL), which had been blamed on hacking collective "Scattered Spider".
Jubair and Flowers hacked TfL between August 31 and September 3, 2024, working up to 16 hours a day - Jubair from his parents' flat in east London, Flowers in his grandmother's home in central England - after gaining access to TfL systems.
Jubair broadcast a livestream of the hack that Flowers watched, with the video found on Flowers' laptop providing key evidence, prosecutor Mark Fenhalls said.
The pair could have "shut down TfL completely" and the attack was stopped only when TfL pulled the plug on their computer systems, Fenhalls said on Thursday.
The damage caused took six months to fix and cost Stg29 million ($A million).
Flowers also admitted conspiring with others to hack two non-profit health systems in the United States just days after targeting TfL, with those attacks stopping "only because he was arrested and literally caught in the act", Fenhalls said.
Flowers continued to attempt hacks from prison after his arrest, Fenhalls said, with devices showing search terms and attempts to access domains linked to the Crown Prosecution Service and the prison where he was held.
Sentencing both Jubair and Flowers to five-and-a-half years in prison, Judge Mark Turner said he accepted they were "primarily motivated by selfish bravado".
British authorities have previously said a hacking collective known as Scattered Spider was responsible for the attack on TfL, with multiple reports also tying the group to an attack on retailer Marks & Spencer.
Jubair and Flowers were 18 and 17 when they targeted TfL but, Fenhalls said, they were already experienced hackers.
Jubair was convicted in 2023 of hacking and blackmailing chipmaker Nvidia as part of the Lapsus$ hacking group and was also sentenced for stalking two young women, including "swatting" one by trying to send armed police to her home.
8°C