Two teenagers charged in TfL cyber attack case

Two teenagers appeared in Westminster Magistrates' Court on Thursday charged in connection with a cyber attack on Transport for London that prosecutors say was 'serious, extensive, sustained and highly sophisticated.' Thalha Jubair, 19, and Owen Flowers, 18, were arrested as part of a National Crime Agency and City of London Police investigation into the incident, which TfL has said cost the agency about £39 million.

The attack, which occurred between Aug. 31 and Sept. 3 last year, disrupted live Tube arrival information on TfL Go and the TfL website while online journey history was unavailable. TfL also reported that it was unable to process Oyster and contactless payments and could not register Oyster cards to customer accounts. The pair are charged with conspiring together to commit unauthorised acts against TfL under the Computer Misuse Act and were arrested as part of a joint investigation by the National Crime Agency and City of London Police. Flowers, of Walsall, was first arrested over the TfL attack in September 2024 and then arrested again this week. He is also charged with targeting US healthcare firms.

The 18-year-old Flowers is accused of conspiring with others to infiltrate and damage the networks of SSM Health Care Corporation and attempting to do the same to Sutter Health. Jubair, from Tower Hamlets, east London, faces an additional charge under the Regulation of Investigatory Powers Act of failing to disclose the PIN or passwords of his devices. The National Crime Agency said investigators believe the TfL attack was carried out by the criminal hacking collective known as Scattered Spider, which has been linked to other cyber attacks on Jaguar Land Rover and retailers including Marks & Spencer.

Deputy Director Paul Foster, head of the NCA's National Cyber Crime Unit, said: 'Today's charges are a key step in what has been a lengthy and complex investigation. This attack caused significant disruption and millions in losses to TfL, part of the UK's critical national infrastructure.' Hannah Von Dadelszen, chief crown prosecutor for the Crown Prosecution Service, said: 'The Crown Prosecution Service has decided to prosecute Jubair and Flowers on computer misuse and fraud related charges following a National Crime Agency investigation into a cyber-attack on the Transport for London network. Our prosecutors have worked to establish that there is sufficient evidence to bring the case to trial and that it is in the public interest to pursue criminal proceedings. We have worked closely with the National Crime Agency as they carried out their investigation.'

Transport for London identified that there had been a cyber attack on Sept. 1 last year, in which customer details including names, contact information and Oyster card refund data including bank details were accessed. The NCA notes that earlier this year it warned of increasing cyber threats from suspects based in the UK and other English-speaking countries, with Scattered Spider cited as a notable example. The police and prosecutors say they will continue to pursue those responsible, with international partners including the FBI assisting in the investigation.