Thalha Jubair and Owen Flowers: Two members of criminal hacking group plead guilty to £39m TfL hack
The National Crime Agency (NCA) has confirmed that two young men admitted their involvement in a cyber attack that cost Transport for London (TfL) an estimated £39 million and caused widespread disruption.
Thalha Jubair, 20, and Owen Flowers, 18, targeted the TfL network between 29 August and 6 September 2024.
The breach required the passwords of 28,000 employees to be reset.
The attack meant data on the Oyster refund system was compromised, customer refunds were delayed and Oyster photo card applications for children and young people were suspended.
The defendants were identified as members of Scattered Spider, a criminal group linked to other high-profile cyber incidents affecting companies such as Jaguar Land Rover and retailers such as Marks and Spencer.
Both men, who initially denied charges of conspiracy to commit unauthorized acts related to the attack, changed their pleas to guilty at Woolwich Crown Court on Monday, just before their trial was due to begin.
Flowers, from Walsall, West Midlands, who was first arrested for the TfL attack in September 2024 and then arrested again in September last year, also admitted targeting US healthcare firms.
He pleaded guilty to conspiring with others to commit unauthorized acts against SSM Health Care Corporation and attempting to commit unauthorized acts against Sutter Health.
The NCA said investigators found a number of electronic devices at Flowers’ home, including laptops, computers, hard drives and USB sticks.
A screenshot showing a connection to TfL’s infrastructure was found on a laptop, while evidence of access to an online tool selling breached credentials was also discovered.
The NCA said officers also found videos recorded by Flowers showing Jubair accessing TfL systems during the attack.
The investigation revealed that the two were messaging via Telegram and collaborating through a shared online workspace.
Jubair, of Tower Hamlets, east London, faced an additional charge under the Investigative Powers Regulations for failing to disclose the Pin or passwords for his devices; He himself denied this, but it remained in the file.
Deputy director Paul Foster, head of the NCA’s national cybercrime unit, said: “Cybercrime may seem faceless and remote compared to other types of crime, but the penetration of TfL systems shows that it has real-world consequences and huge impacts on the public.
“The attack caused millions of pounds of loss to a significant part of the UK’s critical national infrastructure and caused significant inconvenience to customers.
“Today’s outcome would not have been possible had TfL not contacted law enforcement early, so I would ask other organizations to do the same in such cases.
“The profile of criminals such as Flowers and Jubair demonstrates the growing threat from cybercriminals in the UK and other English-speaking countries, exemplified by Scattered Spider.
“That’s why we’re working closely with our partners at home and abroad to identify criminals in these networks and bring them to justice.”
The couple will be sentenced in the same court on July 15 and 16.
Andy Lord, London’s transport commissioner, said: “We welcome the news that two men charged in connection with the cyber incident affecting our operations in 2024 have now pleaded guilty.
“The security of our systems and customer data is extremely important to us and we constantly monitor our systems to ensure only authorized individuals can access them and continue to take the necessary precautions to protect TfL.
“We thank the hard work of our staff, the National Crime Agency and our partners for their investigations into this incident.”
