After it left the capital’s transport authority battling months of disruption and millions in damages, Two teenagers have been charged over a cyber attack on Transport for London.
Two teenagers have been charged over a cyber attack on Transport for London that left the capital’s transport authority battling months of disruption and millions in damages.
The National Crime Agency (NCA) said the hack, which began on 31 August last year, is believed to have been carried out by members of the cyber-criminal group Scattered Spider.
Thalha Jubair, 19, from east London, and Owen Flowers, 18, from Walsall in the West Midlands, were arrested at their home addresses on Tuesday (16.09.25) in a joint operation between the NCA and City of London Police.
Paul Foster, deputy director of the NCA’s National Cyber Crime Unit, said in a statement: “This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure.
“Today’s charges are a key step in what has been a lengthy and complex investigation.”
Both teenagers appeared at Westminster magistrates court on Thursday (18.09.25) afternoon charged with conspiring to commit unauthorised acts against TfL under the Computer Misuse Act.
They have been remanded in custody and will appear at Southwark crown court at a later date.
According to TfL, the breach caused £39 million in damage and left several of its online services offline for three months.
While trains, buses and the wider transport network were unaffected, information boards and digital systems across London went dark.
As part of the recovery, around 25,000 TfL staff were required to report to offices across the city to have their identities verified.
The authority also wrote to approximately 5,000 customers to warn their data – including names, email addresses, home addresses, bank account numbers and sort codes – may have been accessed without permission.
The court heard Flowers was already on bail at the time of the hack.
After his arrest, detectives uncovered evidence that he had attempted to infiltrate systems belonging to US healthcare providers. He now also faces charges of conspiring to damage networks at SSM Health Care Corporation and attempting the same against Sutter Health.
When Flowers appeared in court on Thursday, he wore a grey hoodie bearing the words “off the grid”. Jubair, sitting next to him, wore a black hoodie and black glasses.
Neither teenager spoke to the other during the brief hearing.
In a statement, TfL said: “We welcome this announcement by the National Crime Agency that two people have now been charged in relation to the cyber incident which impacted our operations last year.”
The NCA has previously warned of the rising threat from cyber criminal gangs based in the UK and other English-speaking countries, highlighting Scattered Spider as a group of particular concern.
Scattered Spider has been linked to attacks on major corporations and public bodies, employing sophisticated “social engineering” techniques to bypass security systems.
Authorities say the group is one of several cyber gangs seeking to exploit weaknesses in national infrastructure and private networks.
The investigation into the TfL hack remains ongoing, with further arrests not ruled out.
Two teenagers charged over cyber attack on Transport for London
