Two teenagers have been charged as part of the National Crime Agency’s investigation into a serious cyberattack on Transport for London (TfL) on 31 August.
In a statement released on Thursday, investigators said they believed the attack was carried out by members of online criminal group known as Scattered Spider.
The attack caused significant disruption to systems like traffic cameras and “dial-a-ride” bookings, inability to process some payments, and compromised personal data of around 5000 customers including names, emails, addresses and some bank details, causing an estimated cost to TfL of around £30 million.
Thalha Jubair, 19, from East London, and Owen Flowers, 18, from Walsall, West Midlands, were arrested at their home addresses on Tuesday by the National Crime Agency (NCA) and City of London Police.
Both appeared at Westminster Magistrates’ Court on Thursday after the Crown Prosecution Service authorised charges of conspiracy to commit unauthorised acts against TfL under the Computer Misuse Act.
Flowers was initially arrested for the attack on TfL on 6 September 2024, when NCA officers identified further potential evidence of offences against US healthcare companies. He was subsequently charged on Thursday with conspiring with others to infiltrate and damage the networks of SSM Health Care Corporation and attempting to do the same to the networks of Sutter Health, both based in the US.
Jubair was also charged under RIPA – the Regulation of Investigatory Powers Act 2000, a British law that regulates the surveillance and investigative powers of law enforcement and intelligence agencies – for failing to disclose the PIN code or passwords for the devices that were seized from him.
Flowers and Jubair have been remanded into custody and are both due to appear at Southwark Crown Court on 16 October 2025.
Deputy director Paul Foster, head of the NCA’s National Cyber Crime Unit, said the two charges represented ‘a significant step’ in a long and complex investigation aimed at tackling cybercriminals based in the UK and other English-speaking countries.
“Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example,” he said.
“The NCA, UK policing and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice,” he added.
Hannah Von Dadelszen, chief crown prosecutor for the Crown Prosecution Service, commented on the arrests: “Our prosecutors have worked to establish that there is sufficient evidence to bring the case to trial and that it is in the public interest to pursue criminal proceedings.”
The charges follow previous arrests made by the National Crime Agency (NCA) in connection with cyber attacks against Marks & Spencer (M&S), The Co-operative and Harrods over the past year, all linked to the Scattered Spider hacking group.
Following an investigation by law enforcement agencies, two 19-year-old men, another 17-year-old man and a 20-year-old woman were arrested in the West Midlands and London in July.
They were arrested on suspicion of Computer Misuse Act offences, blackmail, money laundering and participating in the activities of an organised crime group.
All four were arrested at their home addresses where their electronic devices were seized for digital forensic analysis.
