Thalha Jubair, 20, and Owen Flowers, 18, could have caused 'catastrophic damage', with more than 27,000 employees affected