Owen Flowers and Thalha Jubair have been charged with conspiring together to commit unauthorised acts against TFL under the UK Computer Misuse Act.
Two UK teenagers have been arrested and charged for allegedly taking part in the 2024 cyberattack on Transport for London (TFL).
In a statement released by the UK National Crime Agency (NCA), the two teenagers, 18-year-old Owen Flowers and 19-year-old Thalha Jubair are thought to be a part of the online cyber criminal group Scattered Spider.
Scattered Spider is a cybercriminal group that targets large companies and their contracted IT help desks. The group is generally believed to be English-speaking adults and teenagers, mainly based in the US and UK.
The group and its tactics have been linked to a number of high-profile attacks, including on Marks and Spencer, Harrods and Victoria’s Secret. Meanwhile, the experts warn that companies such as Forbes, Instacart, Louis Vuitton and Nike could also have been targeted.
Last year, TFL was struck with a cyberattack that affected the organisation’s backroom systems at the corporate headquarters. The attack caused online service disruptions for three months.
According to the NCA, Flowers and Jubair were arrested from their home addresses on 16 September. Yesterday (18 September), they appeared at the Westminster Magistrates Court, after the Crown Prosecution Service authorised they be charged with conspiring together to commit unauthorised acts against TFL, under the Computer Misuse Act.
Flowers was initially arrested for the TFL attack back in September 2024. At the time, NCA officers said they identified his potential involvement against cyberattacks on US healthcare companies.
Yesterday, he was additionally charged with conspiring with others to infiltrate and damage the networks of SSM health Care Corporation and Sutter Health, two US healthcare firms.
Meanwhile, Jubair has been additionally charged under the Regulation of Investigatory Powers Act for allegedly failing to disclose the passwords for the devices authorities seized from him.
“Today’s charges are a key step in what has been a lengthy and complex investigation,” said NCA deputy direct Paul Foster and the head of the NCA’s National Cyber Crime Unit.
“This attack caused significant disruption and millions in losses to TFL, part of the UK’s critical national infrastructure.”
Across the pond, the US Department of Justice (DOJ) unsealed federal charges against Jubair. Prosecutors in the country are accusing the 19-year-old of being involved in “at least 120 computer network intrusions and extortion involving 47 US entities”. The complaint states that victims forked out “at least” $115m in ransom payments.
“Jubair is alleged to have participated in a sweeping cyber extortion scheme carried out by a group known as Scattered Spider,” said acting assistant attorney general Matthew R Galeotti from the DOJ’s criminal division.
According to the complaint, Jubair allegedly used social engineering to gain unauthorised access to computer networks of US companies, steal and encrypt information, and demand ransom payments from victims.
The complaint accuses Jubair of taking part in such schemes in October 2024 and January 2025 to illegally gain access to the networks of US-based critical infrastructure companies and the US courts.
Jubair is charged with computer fraud conspiracy, two counts of computer fraud, wire fraud conspiracy, two counts of wire fraud and money laundering conspiracy. If convicted, he faces a maximum penalty of 95 years in prison.
Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.
