Two teenagers have been charged as part of the National Crime Agency's investigation into a serious cyberattack on Transport for London (TfL) on 31 August.

In a statement released on Thursday, investigators said they believed the attack was carried out by members of the online criminal group known as Scattered Spider.

The attack caused significant disruption to systems including traffic cameras and "dial-a-ride" bookings, rendered some payments unprocessable, and compromised personal data of around 5,000 customers—including names, email addresses, home addresses, and some bank details. The incident caused an estimated £30 million in costs to TfL.

Thalha Jubair, 19, from east London, and Owen Flowers, 18, from Walsall in the West Midlands, were arrested at their home addresses on Tuesday by the National Crime Agency (NCA) and City of London Police.

Both appeared at Westminster Magistrates' Court on Thursday after the Crown Prosecution Service authorised charges of conspiracy to commit unauthorised acts against TfL under the Computer Misuse Act.

Flowers was initially arrested in connection with the TfL attack on 6 September 2024. However, when NCA officers identified further potential evidence of offences against US healthcare companies, he was subsequently charged on Thursday with conspiring with others to infiltrate and damage the networks of SSM Health Care Corporation and attempting to do the same to Sutter Health's networks, both US-based companies.

Jubair was also charged under the Regulation of Investigatory Powers Act 2000 (RIPA)—British legislation that regulates the surveillance and investigative powers of law enforcement and intelligence agencies—for failing to disclose PIN codes or passwords for devices seized from him.

Both Flowers and Jubair have been remanded in custody and are due to appear at Southwark Crown Court on 16 October 2025.

Paul Foster, deputy director and head of the NCA's National Cyber Crime Unit, described the charges as representing "a significant step" in a lengthy and complex investigation aimed at tackling cybercriminals based in the UK and other English-speaking countries.

"Earlier this year, the NCA warned of an increase in the threat from cybercriminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example," he said.

"The NCA, UK policing, and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice," he added.

Hannah Von Dadelszen, chief crown prosecutor for the Crown Prosecution Service, commented on the arrests: "Our prosecutors have worked to establish that there is sufficient evidence to bring the case to trial and that it is in the public interest to pursue criminal proceedings."

The charges follow previous arrests made by the NCA in connection with cyberattacks against Marks & Spencer, The Co-operative, and Harrods over the past year, all linked to the Scattered Spider hacking group.

Following an investigation by law enforcement agencies, two 19-year-old men, a 17-year-old man, and a 20-year-old woman were arrested in the West Midlands and London in July.

They were arrested on suspicion of Computer Misuse Act offences, blackmail, money laundering, and participating in the activities of an organised crime group. All four were arrested at their home addresses, where their electronic devices were seized for digital forensic analysis.

---