Teen hackers accused of £39m cyberattack on TfL

Two teenagers accused of carrying out a “serious, extensive, sustained, and highly sophisticated” cyberattack on Transport for London (TfL) have appeared in court.

Thalha Jubair, 19, and Owen Flowers, 18, were both arrested on Tuesday as part of an investigation by the National Crime Agency (NCA) and City of London Police.

At Westminster Magistrates’ Court on Thursday, prosecutors said the alleged cyberattack resulted in a £39 million loss for TfL as well as a “loss of livelihood” for people dependent on TfL licenses.

The two defendants are charged with conspiring together to commit unauthorized acts against TfL, under the Computer Misuse Act.

The alleged attack posed “significant risk” to the UK economy and London residents, the court was told.

Flowers, of Walsall, West Midlands, who was first arrested over the TfL attack in September 2024 and then arrested again this week, is also charged with targeting US healthcare firms.

He is accused of conspiring with others to infiltrate and damage the networks of SSM Health Care Corporation and attempting to do the same to Sutter Health.

Jubair, from Tower Hamlets, east London, faces an additional charge under the Regulation of Investigatory Powers Act (Ripa) of failing to disclose the Pin or passwords of his devices.

The NCA said investigators believe the TfL cyberattack was carried out by the criminal hacking collective known as Scattered Spider, which has been linked to other cyberattacks on Jaguar Land Rover and retailers including Marks and Spencer.

Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said: “Today’s charges are a key step in what has been a lengthy and complex investigation.

“This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure.

“Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example.

“The NCA, UK policing and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice.”

Hannah Von Dadelszen, chief crown prosecutor for the Crown Prosecution Service, said: “The Crown Prosecution Service has decided to prosecute Thalha Jubair and Owen Flowers with computer misuse and fraud related charges following a National Crime Agency investigation into a cyber-attack on the Transport for London network.

“Our prosecutors have worked to establish that there is sufficient evidence to bring the case to trial and that it is in the public interest to pursue criminal proceedings.

“We have worked closely with the National Crime Agency as they carried out their investigation.”

Transport for London identified that there had been a cyberattack on September 1 last year, in which customer details including names, contact information, and Oyster card refund data including bank details were accessed.