Two young men from East London and Walsall have admitted hacking Transport for London’s computer network in a cyber attack that cost the organisation £29 million and caused severe disruption to thousands of customers. The attack took place between 31 August and 3 September 2024 and was investigated by the National Crime Agency (NCA) and City of London Police (COLP).
Massive TFL System Breach
Thalha Jubair, 20, and Owen Flowers, 18, infiltrated TfL’s network, forcing 28,000 employees to reset passwords at an office. The attack affected TfL’s Oyster refunds system, delaying refunds and suspending the application process for children’s and young people’s Oyster photocards.
Evidence And Arrests
Flowers was arrested on 6 September 2024, with devices seized showing links to TfL’s infrastructure and access to a database of breached credentials. Footage was found of Jubair accessing the network during the attack. Both were arrested on 16 September last year and linked to the online criminal group Scattered Spider.
Legal Proceedings And Sentencing
Initially scheduled for trial at Woolwich Crown Court on 22 June 2025, both men pleaded guilty on the first day. They await sentencing on 16 July 2025.
Law Enforcement Response
Paul Foster, Deputy Director of the NCA’s National Cyber Crime Unit, said:
“This has been a lengthy, highly complex and painstaking investigation. The attack caused millions of pounds in losses and major disruption to the public. We urge organisations to report incidents early to aid investigations.”
Deputy Commissioner Nik Adams, City of London Police, added:
“Cyber criminals targeting critical infrastructure cause real harm. This result shows the strength of our partnership with the NCA in protecting the UK.” The investigation was supported by the West Midlands Regional Organised Crime Unit and British Transport Police. Victims of cybercrime are advised to use the government’s Cyber Choices programme and reporting guidance.
