Intercity rail travellers face potential disruption this summer across Great Britain’s three north-south mainlines, with drivers voting on strike action on two lines and timetables slashed on the other owing to malfunctioning trains.

East Midlands Railway announced it will cancel hundreds of services in the coming weeks from its intercity timetable on the Midland mainline, because of continued problems with its fleet of Hitachi trains.

The train drivers’ union Aslef has called a strike ballot on LNER, which runs trains between London and Scotland, after a pay deal fell through. Drivers are already voting whether to strike over pay at Avanti West Coast.

EMR is cancelling about 20 fast trains a day between London, Sheffield and Nottingham, while others will also be short-formed and are likely to be crowded. Its new class 810 fleet, previously labelled Auroras when their launch was heralded less than a year ago, have suffered from what EMR has called “performance and reliability issues”.

The operator also criticised Hitachi’s maintenance of the existing fleet that the Auroras were due to replace, the class 222 trains, which it said had “significantly impacted upon EMR’s ability to run a consistent intercity service”.

Will Rogers, the managing director of EMR, said: “The performance of the class 810 fleet has fallen below the levels we and our customers expect, and it is necessary to introduce a temporary reduced timetable while we work with the manufacturer, Hitachi Rail, to improve consistency in service.

“We are sorry for the significant disruption and inconvenience these issues have caused our customers, and we are committed to restoring the reliable service they rightly expect.”

The bi-mode trains, which run on diesel and electricity, have been introduced into service this year after a three-year delay.

Investigations into the fatal Bedford rail crash last month are still trying to ascertain what caused one of EMR’s new Aurora trains to stop on the mainline, apparently due to a fault with the automatic warning system, before being struck by another EMR train that had passed a red light.

Train drivers on the two other intercity mainlines running north from London could all be on strike by late August, after Aslef called a ballot on LNER on Friday.

Dave Calfe, the union’s general secretary, said: “The company’s failure to make a suitable offer is unacceptable and that’s why we are balloting our members for industrial action.”

The union said the Department for Transport had refused to sign off a pay deal agreed at the state-owned East Coast operator.

Two weeks ago Aslef announced a similar vote at Avanti West Coast over frustrated pay negotiations. The union has not renewed a rest day working agreement, leading to some cancellations.

The DfT was approached for comment.

The start of the peak summer season is set to bring millions of drivers on to British roads, with concerns of traffic chaos as the port of Dover faces its biggest test yet of new EU border controls.

The semi-functioning entry-exit system (EES) is credited, along with the heatwaves and fears about flights after the war in Iran, with helping push British domestic holidays to its highest levels since Covid halted international travel.

Motoring organisations expect this Friday to kick-off the busiest summer weekend for domestic leisure trips.

The port of Dover is bracing for long tailbacks as thousands of holidaymakers join lorries at Britain’s main Channel ferry crossing from 6am.

French border police, situated at Dover, will manually register non-EU travellers for EES. The new £40m automated facility built to speed through passengers is unable to operate due to software problems in the technology in France.

Even though the French police aux frontières (PAF) will not be able to carry out the biometric registration required by EES – photographing and fingerprinting – the additional time needed to create a file for each visitor could still lead to long queues at the border, the port fears.

About 7,500 cars travelling to France are expected at Dover on Friday, and 10,000 on Saturday, as peak summer season begins.

The port has urged holidaymakers to use only main roads when driving to the port, and arrive no more than two hours before their booked sailing.

Eurotunnel, operator of LeShuttle, which takes vehicles through the Channel tunnel, said that it did not anticipate delays as summer traffic built up. As at Dover, border police will still not be registering biometric information from its car passengers for EES this summer. Eurotunnel has likewise spent millions of pounds on automated processing kiosks which cannot yet be brought into service.

Elsewhere, the RAC and Inrix expect the worst of the traffic on Friday in areas of the M25 around Greater London linking to the M3 to the southwest, as more than 14 million drivers make a getaway this weekend.

With most schools in England and Wales closing this weekend for the summer, most leisure journeys will take place on Saturday, the RAC said, as part of the biggest domestic getaway since 2022.

Spokesperson Harriet Hernando said: “The great British summer staycation is about to get off to a flying start, with many opting to stay in the UK instead of travelling abroad. This could be down to people having more confidence in the weather, as well as concerns over cancelled flights, higher air fares and EU border delays, which are no fun with a family in tow.”

But she warned that the June heatwave had seen a spike in breakdowns and urged drivers to be prepared for what the RAC called a “Saturday summer scramble”, adding: “People should prepare for delays and getting stuck in a jam in potentially very hot weather.”

The AA meanwhile said its surveys showed about one in five drivers would be setting off on a leisure journey of 100 miles or more in the next week, the busiest week of the summer for road trips, with more potentially drawn to the coast if hot weather persists.

London Heathrow airport said this weekend would see the start of its peak summer season, with Friday likely to be the busiest day. Travel association Abta expects the main getaway for Britons going abroad to follow next weekend.

Passengers flying into the Schengen area of 29 EU countries will undertake EES formalities at the airport on landing and departure.

Europe’s biggest carrier, Ryanair, warned again this week that UK passengers could be “the testing ground for unfinished border infrastructure”, and told customers to prepare for long possible queues. It identified a number of popular holiday airports including Lisbon, Tenerife South, Alicante, Malaga and Milan Bergamo as “recurring hotspots” for EES-related delays.

The data of millions of commuters was stolen, Londoners were left out of pocket and 27,000 Transport for London staff were forced to reset their passwords.

Over four days in 2024 a pair of teenage hackers had London’s transport network at their mercy. Thalha Jubair and Owen Flowers had burrowed into the heart of Transport for London’s IT systems and held the “keys to the kingdom”.

While the main tube and bus networks were not directly affected, the dial-a-ride service for disabled passengers was unable to process bookings for a period. The head of TfL, Andy Lord – a veteran of British Airways – said the attack was the worst incident he had faced in his career.

TfL said the attack, which occurred between 31 August and 3 September 2024, could have caused “catastrophic damage” to its technology systems and could have led to “significant and extended transport service degradation and disruption”.

In the end, the duo were only stopped when TfL in effect “pulled the plug” on its systems.

They pleaded guilty in June, and on Thursday Jubair was sentenced to five and a half years for the attack, and Flowers to five and a half years for the TfL crime as well as for hacking two US healthcare providers.

At one point, according to prosecutors in the case, Jubair and Flowers “could have shut out and shut down TfL completely” having hacked their way to the “highest privileged access” in the system and creating a “domain admin” account described in court as “the keys to the kingdom”. They even searched through TfL’s customer database for celebrities.

The two hackers had led apparently closeted, online lives which nonetheless had a disproportionate impact on the outside world.

Jubair, 20, lived with his parents in a council flat in Bow, east London, and Flowers, 19, lived with his grandmother and uncle in a three-bedroom property in Walsall, in the West Midlands. They had communicated with each other throughout the hack using the Telegram messaging service, and Flowers recorded a livestream of the attack that Jubair broadcast while he carried out the multi-day crime.

Both were key figures within a loose collective of English-speaking hackers known as Scattered Spider, which is suspected of numerous hacks in recent years. The pair’s activities had made them wealthy, accruing millions of dollars in cryptocurrency.

The Scattered Spider name was conferred on these hackers by cybersecurity researchers who create monikers for the groups they monitor. Jubair and Flowers embraced it, exchanging messages citing Scattered Spider during the attack. Flowers warned his counterpart that his “scattered spider lvl 5 pass will be revoked” as he appeared to complain about Jubair’s slow progress. In a later group chat Jubair wrote: “SCATTERED SPIDER IS CREATING WEBS ON THE UNDERGRND.”

Flowers was known to have spent most of his time in his bedroom playing video games – a typical pathway for hackers – and using chat forums. Jubair also started out in the gaming world and would disrupt other players by stealing their usernames, before he moved into criminal activity.

Jubair, whose father is a care worker and whose mother had given up her job to act as a full-time carer for her son, was a hacker from a young age. He went to school locally, passed a number of GCSEs and had attempted to enrol at colleges. But he had always been interested in computing and gaming.

A two-day sentencing hearing at Woolwich crown court this week heard that Jubair was shown how to use a smartphone at the age of four, had a laptop and was gaming from the age of six or seven, was writing his own computer programs by the age of 10, and at 13 was introduced to hacking by older hackers.

Before the TfL conviction, Jubair had been convicted of 22 offences as a teenager, including 13 counts of fraud, two of unauthorised access to a computer, one of obtaining access to a computer, and one of blackmail. He had also been convicted in a youth court of stalking two young women and hacking into a City of London police server. Jubair was 18 when he carried out the TfL hack.

Both defendants have been diagnosed with autism, and Jubair has depression and a severe mood disorder. Woolwich crown court heard that Jubair had tried to kill himself and that from a young age he was “isolated and bullied at school”. On behalf of Flowers, who was 17 when he carried out the hack, Adam Davis KC described his client as an “immature child trying to show off online”, who had been through an “unsettled childhood” that included contact with children’s services a year after he was born. Davis said Flowers had experienced “significant” isolation throughout his childhood and struggled with social relationships.

Flowers, too, had been active before the TfL cyber-attack. He was previously known to police and came into contact with them after turning 16. He had been subject to a cease-and-desist notice issued by West Midlands police in October 2023. Flowers was offered training to guide him away from cybercrime, which he turned down, and was given advice over computer misuse offences.

The TfL hack was not a “ransomware” attack, whereby IT systems are encrypted and data is stolen, allowing hackers to demand a ransom in cryptocurrency for decryption and return of the data.

Nonetheless, Jubair and Flowers have come into contact with vast sums of money. A previous hearing was told that $10m (£7.5m) was moved from Jubair’s crypto wallets after he was released from custody in March last year and $200m vworth of crypto had also moved through accounts belonging to him. An earlier hearing was also told that Flowers held $7.1m, including crypto, in accounts he controlled, despite having no source of income.

Neither appeared to have a lavish lifestyle. Flowers’s crypto account had been used to pay for food deliveries, while US authorities were able to trace Jubair because he paid for food deliveries using gift cards bought with crypto from an account that allegedly stored ransomware payments. Experts point to evidence that Scattered Spider attacks are often driven more by a desire for bragging rights and notoriety than financial gain.

The court heard that the TfL attack prevented live tube arrival information from appearing on the TfL Go app and the TfL website, while TfL was also unable to process any payments on the Oyster and contactless apps or to register Oyster cards to customer accounts. The attack cost TfL £39m, comprised of £29m in damage caused to IT systems and £10m in loss of income. The data of about 7 million people was also stolen.

The court heard that Jubair and Flowers got into TfL’s systems via an unnamed co-conspirator who called the TfL help desk and pretended to be an employee struggling to access the network remotely. A call handler was tricked into resetting the authentication process to a device in control of Jubair and Flowers, who then set about escalating their access.

Paul Foster, the head of the National Crime Agency’s national cyber crime unit, said the convictions had severely affected the Scattered Spider group. “Their activities and their impact have now been severely degraded as a result of this action.”

At one point during the attack, Flowers unwittingly foretold the consequences of their actions. Messaging Jubair, he said: “u won’t be laughing when ur sat in prison.”