Two Teenagers Charged Over Multi-Million Pound TfL Cyber Attack

Two teenagers have been charged in connection with a cyber attack on Transport for London (TfL) that resulted in millions of pounds in losses.

Investigators believe the August 2024 “network intrusion” was carried out by the criminal hacking group Scattered Spider.

Thalha Jubair, 19, from east London, and Owen Flowers, 18, from Walsall, were arrested on Tuesday at their homes as part of a National Crime Agency (NCA) and City of London Police operation. Both are due to appear at Westminster Magistrates on Thursday, charged with conspiring to commit unauthorised acts against TfL under the Computer Misuse Act.

The attack on 31 August 2024 accessed customer data, including names and contact details. While it did not disrupt transport services, TfL reported significant financial losses and had to temporarily suspend traffic cameras, “dial-a-ride” bookings, and some payment processing. At the time, the operator described the attack as “sophisticated” and “aggressive.”

Flowers faces additional charges relating to alleged attempts to infiltrate the networks of US healthcare companies SSM Health Care Corporation and Sutter Health. Jubair has also been charged with failing to disclose PINs or passwords for devices seized from him.

Paul Foster, deputy director and head of the NCA’s Cyber Crime Unit, called the charges a “key step” in a “lengthy and complex investigation,” stressing the importance of protecting the UK’s critical infrastructure. He praised TfL for its “swift action” in reporting the attack and cooperating with authorities.

Scattered Spider has been linked to large-scale attacks on UK retailers this year, including M&S, the Co-op, and Harrods. The NCA investigation has also involved the West Midlands Regional Organised Crime Unit and British Transport Police.