Teen hackers charged over Scattered Spider assault on TfL
Two males, named as Owen Flowers and Thalha Jubair, have right now appeared earlier than Westminster Justice of the Peace’s Courtroom in reference to a 2024 cyber assault on Transport for London (TfL), after being arrested by the Nationwide Crime Company (NCA) and Metropolis of London Police on 16 September 2025.
Flowers, of Walsall within the West Midlands, was arrested and questioned over the cyber assault on TfL in September 2024, however as he was a minor on the time, his id couldn’t be formally revealed.
The assault on TfL, attributed to the Scattered Spider hacking collective, didn’t cease core public transit companies such because the London Underground from working. Nevertheless, it did trigger important disruption to some technical companies, together with third-party software programming interfaces utilized by the likes of Citymapper, and logins for contactless and Oyster fee accounts.
The incident has value TfL properly over £30m thus far, with at the least £5m of that whole spent on response, investigation and remediation.
Paul Foster, NCA deputy director and head of the Nationwide Cyber Crime Unit, described the fees as a key step in a prolonged and sophisticated investigation. “This assault brought on important disruption and hundreds of thousands in losses to TfL, a part of the UK’s crucial nationwide infrastructure,” he mentioned.
“Earlier this yr, the NCA warned of a rise within the menace from cyber criminals primarily based within the UK and different English-speaking nations, of which Scattered Spider is a transparent instance,” mentioned Foster.
“The NCA, UK policing and our worldwide companions, together with the FBI, are collectively dedicated to figuring out offenders inside these networks and making certain they face justice.”
Transparency praised
Foster went on to reward TfL for working transparently with the investigation, and remarked that the arrests demonstrated what legislation enforcement is ready to obtain when victims are empowered to come back ahead and report incidents.
Hannah von Dadelszen, chief crown prosecutor for the Crown Prosecution Service (CPS), added: “The Crown Prosecution Service has determined to prosecute Thalha Jubair and Owen Flowers with laptop misuse and fraud associated prices – following a Nationwide Crime Company investigation right into a cyber assault on the Transport for London community.
“Our prosecutors have labored to determine that there’s ample proof to convey the case to trial and that it’s within the public curiosity to pursue felony proceedings,” she mentioned. “We’ve labored carefully with the Nationwide Crime Company as they carried out their investigation.”
Flowers, aged 18, is charged with three counts of conspiracy to commit an unauthorised act in relation to a pc inflicting and/or creating threat of significant harm to human welfare and/or nationwide safety below the Laptop Misuse Act (CMA) of 1990.
One in every of these counts pertains to the TfL incident, the opposite two relate to offences in opposition to two targets within the US, SSM Well being Care Company and Sutter Well being.
Jubair, aged 19, of Tower Hamlets in London, can be charged with conspiracy to commit an unauthorised act in relation to a pc inflicting and/or creating threat of significant harm to human welfare and/or nationwide safety, however solely in relation to the TfL assault.
He faces a further cost of failure to adjust to a Part 49 discover issued below the Regulation of Investigatory Powers Act (RIPA) of 2000, for failing to show over the PIN or passwords to gadgets seized from him as a part of the investigation.
Scattered Spider connections
The arrests of Flowers and Jubair come two months after 4 as-yet unnamed folks have been arrested in reference to the Scattered Spider assaults on UK retailers. As was the case then, the NCA is once more considerably restricted within the quantity of element it is ready to present at this stage of the authorized course of.
Nevertheless, company workers did verify their sturdy perception that each Flowers and Jubair are concerned within the Scattered Spider cyber crime collective, though they urged in opposition to hypothesis on any hyperlink to the group’s different actions at this stage.
Laptop Weekly understands Flowers and Jubair have been on the radar of legislation enforcement for a while, and each males have been publicly recognized and linked to varied different Scattered Spider and Lapsus$ cyber assaults previously.
