On 22 June, Thalha Jubair, 20, and Owen Flowers, 18, pleaded guilty at Woolwich Crown Court on the very day their trial was set to begin, in connection with a cyber attack on Transport for London (TfL) carried out between 29 August and 6 September 2024. According to a statement from the UK’s National Crime Agency (NCA), the attack cost TfL approximately £39 million, forced 28,000 employees to attend in person for password resets, resulted in access to data from the Oyster refund system, delayed some user refunds, and forced the suspension of applications for children’s and young people’s Oyster photocards. The pair admitted their guilt on the basis of “reckless disregard for the consequences” rather than an intention to cause damage. The NCA confirmed that both are members of the hacker group Scattered Spider, which has also been linked to cyber attacks on retailers including Jaguar Land Rover and Marks & Spencer.
During the investigation, officers seized multiple laptops, hard drives and USB storage devices from Flowers’ home, one of which contained screenshots showing him connected to TfL’s infrastructure. Investigators also discovered a video recorded by Flowers showing Jubair accessing TfL systems during the attack. Flowers further pleaded guilty to conspiracy to commit unauthorised acts against US healthcare provider SSM Health Care Corporation, and to attempting to attack Sutter Health. Jubair also faced a separate charge under the Investigatory Powers Act for refusing to disclose a device password, which was ordered to be filed at court. The two are due to be sentenced at the same court on 15 and 16 July respectively. Paul Foster, Deputy Director of the NCA’s Cyber Crime Unit, said the investigation had been lengthy and highly complex, and reiterated his call for organisations that have been attacked to proactively engage with law enforcement at an early stage.