NCA Arrests Two Teens Linked to Transport for London Cyberattack

The National Crime Agency has arrested two teenagers in connection with the major data security incident that significantly affected Transport for London in August 2024.

 

In August 2024, the transportation company said it was “dealing with an ongoing cyber security incident” but assured riders that none of its essential operations were compromised or disrupted. Tfl added it worked with relevant law enforcement authorities, including the National Crime Agency and the National Cyber Security Centre, to respond to the incident.

 

In a recent press release, the National Crime Agency announced that on September 16, two teenagers, Thalha Jubair from East London and Owen Flowers from Walsall, were arrested at their homes by officers from the NCA and City of London Police. Both were subsequently brought before Westminster Magistrates’ Court after the Crown Prosecution Service authorised charges against them for conspiring to commit unauthorised acts against Transport for London under the Computer Misuse Act.

 

Flowers was initially arrested on September 6, 2024, in connection with the TfL attack but was released on bail after questioning by NCA officers. However, new evidence has since emerged linking him to offences against US healthcare companies. As a result, Flowers has now been charged with conspiring with others to infiltrate and damage the networks of SSM Health Care Corporation, as well as attempting similar actions against Sutter Health’s networks, both based in the United States.

 

Jubair has been charged under the Regulation of Investigatory Powers Act (RIPA) for failing to disclose the PINs or passwords for devices seized from him. Both Flowers and Jubair have been remanded in custody and are scheduled to appear at Southwark Crown Court on October 16, 2025.

 

The NCA added that investigators believe the cyber attack on TfL was carried out by members of the online criminal collective known as Scattered Spider, of which both Jubair and Flowers are possible members.

 

In a statement shared with the media, Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said, “Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example. 

 

“The NCA, UK policing and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice.” Deputy Director Foster added.