Two Men Admit Guilt in £39 Million Transport for London Cyber Attack Case
Thalha Jubair, 20, of east London, and Owen Flowers, 18, of Walsall, have admitted to charges stemming from a significant cyber attack against Transport for London (TfL). The incident resulted in months of service disruption and a reported cost of £39 million to the operator.
The pleas were entered at Woolwich Crown Court on Monday, the day a six-week trial was scheduled to commence. Both individuals pleaded guilty to conspiring to commit unauthorised acts against TfL under the Computer Misuse Act.
TfL previously stated the cyber attack, which began on 31 August 2024, disrupted its services for three months and affected 10 million customers. The defendants entered their pleas on the premise that their access to the systems was reckless rather than intentionally malicious.
In addition to the TfL charges, Flowers also pleaded guilty to attempting to hack computer systems belonging to California-based Sutter Health and SSM Healthcare Corporation, another US company.
The disruption to TfL's online services meant customers were unable to view certain information boards, which went offline during the attack. The transport operator subsequently notified thousands of customers regarding unauthorised access to some personal information.
Investigators from the National Crime Agency (NCA) had previously attributed the summer 2024 network intrusion to the online criminal group known as Scattered Spider, at the time of Flowers and Jubair's arrests.
Judge Mr Justice Turner acknowledged the legal teams' efforts, thanking them for the "hard work" that facilitated a "satisfactory way forward" in the case.
