Two charged over TfL cyberattack linked to Scattered Spider

Attacks cost TfL a reported £39m

Two young men have appeared in court charged over the cyberattack that caused months of disruption to Transport for London (TfL) last year.

The National Crime Agency (NCA) said it believes the attack, which began on 31 August 2024, was carried out by members of the cybercrime group Scattered Spider.

Thalha Jubair, 19, from East London and Owen Flowers, 18, from Walsall, were arrested at their homes earlier this week in a joint operation by the NCA and City of London Police.

On Thursday afternoon the pair appeared at Westminster Magistrates’ Court, charged with conspiring to commit unauthorised acts against TfL under the Computer Misuse Act. Both were remanded in custody and will appear at Southwark Crown Court at a later date.

TfL said the incident cost the organisation £39 million and disrupted services for three months. While trains and buses continued running, many of TfL’s online services were unavailable and information boards at stations were affected.

The authority also wrote to around 5,000 customers warning that personal details, including bank account numbers, sort codes, names, email addresses and home addresses, may have been accessed.

The court heard that Flowers allegedly carried out the TfL attack while on bail. Detectives said they later found evidence linking him to attacks on two US healthcare organisations, SSM Health Care Corporation and Sutter Health. He now faces additional conspiracy charges relating to those cases.

Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said: “Today’s charges are a key step in what has been a lengthy and complex investigation. This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure.”

TfL said its recovery operation involved 25,000 staff undergoing identity checks at offices across London. In a statement it added: “We welcome this announcement by the National Crime Agency that two people have now been charged in relation to the cyber incident which impacted our operations last year.”

The NCA has previously warned of a rising threat from UK-based and English-speaking cybercrime groups such as Scattered Spider.