Advertisement
Teens plead not guilty in a major transport cyber attack
21st November, 2025 05:57 PM
Two teenagers have pleaded not guilty in connection with a cyber attack on Transport for London, which cost millions of pounds.
Investigators believe the “network intrusion” in summer 2024 was carried out by the online criminal group known as Scattered Spider.
Thalha Jubair, 19, from east London, and Owen Flowers, 18, from Walsall in the West Midlands, were arrested at their homes in September.
They were detained as part of an operation by officers from the National Crime Agency (NCA) and City of London Police.
Both have appeared before Southwark Crown Court and entered not guilty pleas to charges of conspiring together to commit unauthorised acts against Transport for London (TfL).
They stood in the dock together and spoke only to confirm their names and enter not guilty pleas.
Flowers and Jubair are both charged with conspiring to commit unauthorised acts against computer systems belonging to TfL between August 29 and September 8, 2024.
As part of that charge, they are accused of “causing, or creating a significant risk of, serious damage to human welfare and intending to cause such damage or being reckless as to whether such damage was caused.”
Flowers, who wore a black t-shirt and a grey jumper around his shoulders, is also accused of unauthorised acts against computer systems belonging to SSM Health and attempting to commit unauthorised acts against computer systems belonging to Sutter Health.
Jubair, who appeared in the dock wearing a grey suit, is accused of failing to disclose the PIN or passwords seized from him on March 19, 2025.
A provisional trial date has been set for June 8, 2026, at Southwark Crown Court, with a pre-trial hearing on February 13, 2026.
TfL was targeted on August 31, 2024, by attackers who accessed customer data, including names and contact details.
The cyber incident did not cause any wider disruption to transport networks, but it has cost the operators millions of pounds in losses and recovery.
At the time, TfL described the attack as “sophisticated” and “aggressive” and was forced to shut down some areas of operation, including traffic cameras and “dial a ride” bookings.
They were also unable to process some payments.
In September 2025, Paul Foster, head of the NCA’s cyber crime unit, described the charges against Jubair and Flowers as a “key step” in a “lengthy and complex investigation.”
“This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure,” he added.
“Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example.
“The NCA, UK policing and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice.”
He also thanked TfL for their “swift action” in reporting the cyber attack and their “engagement” with the NCA on the investigation.
