Two Individuals Plead Guilty to Major Cyber Attack on Transport for London
Two young men have pleaded guilty to orchestrating a significant cyber intrusion against Transport for London (TfL). The attack resulted in financial losses amounting to tens of millions of pounds and caused substantial disruption for thousands of passengers and staff.
The National Crime Agency (NCA) and City of London Police conducted the investigation into Thalha Jubair, aged 20 and residing in East London, and Owen Flowers, aged 18 from Walsall in the West Midlands. The breach of TfL’s systems occurred between 31 August and 3 September 2024. Both individuals were affiliated with the cyber criminal group known as Scattered Spider. They were arrested at their respective addresses on 16 September 2024.
The attackers gained unauthorised access to TfL’s network, necessitating that all 28,000 employees visit a TfL office in person to reset their passwords. The incident led to reported losses and recovery expenses of £29 million.
In addition, data within the Oyster card refund system was compromised, which delayed customer reimbursements and temporarily suspended the application process for Oyster photocards intended for children and young people.
Flowers was first arrested on 6 September 2024 in connection with the TfL incident. Further inquiries revealed evidence of his involvement in compromising networks belonging to US healthcare providers SSM Health Care Corporation and Sutter Health.
Searches at his residence uncovered various electronic devices, including laptops, desktop computers, hard drives, and USB storage media.
One Acer laptop contained evidence of network access to TfL infrastructure, along with screenshots and videos documenting the intrusion.
These recordings captured Jubair accessing TfL systems while the pair communicated in real time via Telegram and a shared online workspace platform.
Flowers was released on bail with stringent conditions, which he violated on two separate occasions in March and May 2025.
The pair were scheduled to appear for trial at Woolwich Crown Court on 22 June but entered guilty pleas on the opening day of proceedings. Sentencing is set for 16 July at the same court.
Official Statements
Paul Foster, Deputy Director and head of the NCA’s National Cyber Crime Unit, described the investigation as lengthy, intricate, and demanding. He commended the diligence of officers and partner agencies, which left the defendants with no alternative but to accept responsibility for their actions.
Foster emphasised the tangible real-world effects of such cyber crimes on public services and infrastructure, highlighting the importance of early engagement by victim organisations with law enforcement.
He also noted the growing involvement of UK-based and English-speaking offenders within groups such as Scattered Spider, underscoring international collaboration efforts.
Deputy Commissioner Nik Adams of the City of London Police stressed the broad impact of the attack on essential public services and daily life. He reaffirmed the commitment of law enforcement to make the UK a hostile environment for cyber criminals through sustained partnership working. The investigation received additional support from the West Midlands Regional Organised Crime Unit and British Transport Police.
Victims of cybercrime are advised to consult the Government’s Cyber Incident Signposting Site to identify the appropriate reporting channels. Individuals seeking to channel their technical abilities positively may refer to the Cyber Choices programme at http://www.cyberchoices.uk.
