Court hearing at Woolwich Crown Court
Two young men have admitted their involvement in a major cyber attack that disrupted Transport for London systems and caused around £39 million in losses.
Thalha Jubair, 20, from east London, and Owen Flowers, 18, from Walsall, changed their pleas on the first day of their trial at Woolwich Crown Court. The trial had been expected to last six weeks.
Both men admitted conspiracy to carry out unauthorised actions against TfL under the Computer Misuse Act. Prosecutors said they accessed systems without permission but claimed they did so recklessly, not with a clear intention to cause disruption.
Impact on TfL services and passengers
The cyber attack began on 31 August 2024 and led to around three months of disruption. Transport for London said about 10 million customers were affected.
Online services stopped working properly during the incident. Some information displays also went offline, causing confusion for passengers.
TfL later contacted thousands of users after discovering that some personal data had been accessed. Refund processing was delayed for many customers, leaving some waiting longer than usual for payments.
The attack also disrupted the Oyster photocard application system, which is used by children and young people.
Allegations and investigation findings
Investigators believe the breach was linked to an online group known as Scattered Spider. The National Crime Agency worked with City of London Police on the case.
Both suspects were arrested at their homes on 16 September 2024. Officers seized laptops, hard drives, USB devices, and desktop computers during the investigation.
Authorities said one device contained evidence linking directly to TfL systems. Investigators also found video material that appeared to show access being gained during the attack.
They also said the pair used Telegram and an online workspace to communicate. Flowers was also found using a platform that sells stolen login credentials.
Other alleged hacking attempts
Flowers admitted additional charges related to attempted hacking of two US healthcare organisations, including Sutter Health and SSM Healthcare Corporation.
Court remarks
The judge thanked all legal teams for their work during proceedings. He said their efforts helped reach a clear outcome in the case.
