Two Teen Hackers Charged in £39 Million TfL Cyber-Attack Linked to Scattered Spider
Our team of experts are dedicated to developing cutting-edge software solutions that provide the ultimate protection for your digital assets
Introduction
In September 2025, two teenagers appeared in court facing charges for a high-profile cyber-attack against Transport for London (TfL). The suspects—19-year-old Thalha Jubair from east London and 18-year-old Owen Flowers from Walsall—are accused of conspiring to commit unauthorised acts under the UK’s Computer Misuse Act. Investigators believe the intrusion, which began in August 2024, was carried out by members of the group known as Scattered Spider.
What Happened at TfL?
- On 31 August 2024, TfL’s systems suffered a network intrusion believed to be linked to Scattered Spider.
- The disruption lasted for about three months, affecting live Tube information boards, online journey histories, and Oyster/contactless accounts.
- TfL estimates around £39 million in overall impact including damage and remediation.
- Approximately 5,000 customers were notified that personal data (bank details, emails, home addresses) may have been accessed.
Who Are the Suspects & What Are the Charges?
- Thalha Jubair (19) and Owen Flowers (18) were arrested on 16 September 2025 by the NCA and City of London Police.
- Both are charged with conspiring to commit unauthorised acts against TfL under the Computer Misuse Act.
- Additional: Owen Flowers allegedly targeted U.S. healthcare networks (e.g., SSM Health, Sutter Health).
- Additional: Thalha Jubair faces RIPA charges for refusing to provide device PINs/passwords to investigators.
- Case timeline: further hearing on 21 November; trial scheduled for 8 June 2026.
Why This Attack Matters
Target: Critical Infrastructure
TfL underpins millions of daily journeys. While trains continued to operate, secondary but essential digital services were disrupted—highlighting the risk to supporting infrastructure and user-facing systems.
High Cost & Data Exposure
With a near-£39 million total impact and the exposure of customer financial/contact data, the incident underscores the real-world financial and privacy harms to public agencies.
Youth & Sophistication in Cyber-Crime
The suspects are teenagers linked to Scattered Spider—an actor known for socially engineered, targeted intrusions—raising concerns about attacker profiles and the need for defenses against social engineering as much as technical exploits.
What Organisations Should Learn
- Prioritise critical digital services. Disruption of APIs, payment portals, and apps can have major operational and financial impact.
- Treat youth-led threat actors seriously. Young operators can deliver significant damage with modern toolsets and guidance.
- Segment and monitor digital assets. Separate payment systems, accounts, and web interfaces; monitor for anomalous behavior.
- Strengthen incident response & notifications. Ensure breach notification, forensic readiness, and remediation budgets are in place.
Conclusion
The TfL incident and subsequent charges highlight an evolving landscape: critical infrastructure agencies must defend against agile, socially engineered operations—not just software vulnerabilities. With costs in the tens of millions and sensitive data exposure, resilience of digital services is as important as physical service continuity.