- Two teenagers charged after TfL cyber attack linked to Scattered Spider criminal collective
- NCA says hack caused millions in losses as TfL operations disrupted for months
- CPS confirms prosecution as both men remanded ahead of October crown court appearance
Two teenage men have been charged over a recent cyberattack which left Transport for London (TfL) battling months of disruption and tens of millions in losses.
The National Crime Agency (NCA) said the intrusion, which began on August 31 2024, was linked to Scattered Spider, a cyber-criminal group it describes as an increasing threat.
Nineteen-year-old Thalha Jubair from east London and eighteen-year-old Owen Flowers from Walsall were arrested at their home addresses by NCA and City of London Police officers.
Significant disruption and millions in losses
Both subsequently appeared at Westminster Magistrates Court, charged with conspiring to commit unauthorized acts against TfL under the Computer Misuse Act.
Flowers was already on bail when the TfL hack took place. After his arrest, officers identified evidence that he had also targeted US healthcare companies for which he now faces additional charges.
Jubair has been charged under the Regulation of Investigatory Powers Act for refusing to provide the passwords for devices seized from him.
Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said: “Today’s charges are a key step in what has been a lengthy and complex investigation. This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure.”
Foster went on to add, “Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example. The NCA, UK policing and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice.”
Both men have been remanded in custody and are due to appear in court in October.
Hannah Von Dadelszen, Chief Crown Prosecutor for the CPS, said, “The Crown Prosecution Service has decided to prosecute Thalha Jubair and Owen Flowers with computer misuse and fraud related charges… Our prosecutors have worked to establish that there is sufficient evidence to bring the case to trial and that it is in the public interest to pursue criminal proceedings.”
TfL said in a statement, “We welcome this announcement by the National Crime Agency that two people have now been charged in relation to the cyber incident which impacted our operations last year.”
The hack forced TfL to write to 5,000 customers warning their bank details and personal information may have been exposed.
While transport services continued, online platforms and digital information systems were shut down for months.
Teenagers are increasingly behind major cyber attacks, including incidents targeting M&S, Co-op and Harrods, while others, some even younger, have been caught hacking their own schools.
Via BBC
