Two teenagers have admitted carrying out a cyber attack on Transport for London that cost the operator £39m and disrupted services for three months, leaving millions of customers unable to access online information boards.
Thalha Jubair, 20, from east London, and Owen Flowers, 18, from Walsall in the West Midlands, changed their pleas on Monday at Woolwich Crown Court – the day their six-week trial was due to begin. They pleaded guilty to conspiring to commit unauthorised acts against TfL under the Computer Misuse Act, on the basis that they had recklessly accessed the systems without intending to do so.
“Two teenagers pleaded guilty to a cyber attack on Transport for London that cost £39m and disrupted services for months.”
The hack began on 31 August 2024 and affected 10m customers, TfL said. The transport operator’s online services were knocked offline, and some information boards went dark. TfL later wrote to thousands of customers to warn them that their personal data had been accessed without authorisation.
Flowers also pleaded guilty to attempting to hack computer systems belonging to two US companies: California-based Sutter Health and SSM Healthcare Corporation.
At the time of their arrests, investigators from the National Crime Agency said they believed the “network intrusion” in summer 2024 was carried out by the online criminal group known as Scattered Spider.
After the guilty pleas were entered, the judge, Mr Justice Turner, thanked all legal representatives, expressing gratitude for the “hard work” that had enabled the court to find a “satisfactory way forward”.
The two men will be sentenced on 15 July.