Pair Accused of TfL Cyberattack Deny Computer Misuse Charges

Two teenagers accused of hacking into the internal network of Transport for London have denied the charges at a hearing held in Southwark Crown Court.

In September 2024, TfL suffered a major cyber attack that disrupted some services, including the Dial-a-Ride service for disabled and elderly people. Core TfL services remained unaffected. However, sensitive personal data of customers was accessed, including names, contact details, and for about 5,000 customers, bank account numbers and sort codes related to Oyster card refunds. 

Some online services, such as Live Tube arrival information and Oyster photocard applications, were temporarily suspended. TfL worked closely with the National Crime Agency (NCA) and the National Cyber Security Centre (NCSC) to investigate and respond to the incident.

The NCA arrested two teenagers, Thalha Jubair from East London and Owen Flowers from Walsall,  in connection with the cyber attack. They were charged under the Computer Misuse Act and linked to a cybercriminal group. The investigation involved cooperation between the NCA, NCSC, and international partners.

Flowers was initially released on bail after NCA questioning, but new evidence linking him to attacks on U.S. healthcare firms led to charges of conspiring to infiltrate and damage SSM Health’s networks and attempting similar actions against Sutter Health. Jubair was charged under the Regulation of Investigatory Powers Act for refusing to provide PINs or passwords for seized devices. Both men were in custody and were scheduled to appear at Southwark Crown Court on 16 October 2025.

The NCA added that investigators believe the cyber attack on TfL was carried out by members of the online criminal collective known as Scattered Spider, of which both Jubair and Flowers are possible members.

According to the BBC, last week, both defendants appeared at Southwark Crown Court and pleaded not guilty to charges of conspiring to carry out unauthorised acts against Transport for London (TfL). Appearing before the court, they spoke only to confirm their identities and enter their pleas. Judge Christopher Hehir scheduled the trial for 8 June next year, with proceedings expected to run for four to six weeks. Both men remain held on remand.