The National Crime Agency (NCA) has arrested and charged two teenagers in connection with the Transport for London (TfL) cyber attack.
Transport for London operates the Underground (the Tube), surface railroads, and bus networks. In August 2024, the transport agency suffered a cyber attack that disrupted operations for three months, resulting in $52 million (£39M) worth of damage.
The attack also compromised personal information, including the names, email addresses, home addresses, and bank account numbers of 5,000 customers.
NCA and the London Police arrest suspects behind the TfL cyber attack
On September 16, 2025, authorities arrested Thalha Jubair, 19, of East London, and Owen Flowers, 18, of Walsall, West Midlands, in connection with the TfL cyber attack. The teenagers were suspected of belonging to the English-speaking hacking group Scattered Spider.
They were arrested at their respective home addresses during a law enforcement operation involving the NCA and the City of London Police.
They appeared before the Westminster Magistrate’s Court, where they confirmed their identities and were charged with “conspiring together to commit unauthorised acts” under the Computer Misuse Act. They will later appear at the Southwark Crown Court to answer the charges.
The arrest also uncovered evidence that indicted Flowers on “conspiring with others to infiltrate and damage” the information systems of three U.S.-based organizations, including Missouri-based Catholic healthcare firm SSM Health Care Corporation and California-based nonprofit healthcare organization Sutter Health.
Flowers had been arrested on September 6, 2024, shortly after the cyber attack. His arrest allowed the NCA to identify other suspects linked to the cyber attack.
Jubair also faces additional charges under the Regulation of Investigatory Powers Act for failing to disclose the login details of electronic devices seized from him, which were potentially used during the cyber attack.
The 19-year-old was also charged in the United States for his alleged involvement in a hacking campaign that affected at least 47 U.S. victims, including critical infrastructure organizations and U.S. Courts, between May 2022 and September 2025. The prosecution alleges that the victims paid at least $115 million in ransom in connection with the cyber attacks.
He was charged with conspiracy to commit computer fraud, wire fraud, and money laundering. If convicted, he faces up to 95 years in federal prison.
“Jubair is alleged to have participated in a sweeping cyber extortion scheme carried out by a group known as Scattered Spider, which committed at least 120 attacks worldwide and resulted in over $115 million in ransom payments from victims,” said Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division.
Meanwhile, NCA’s Deputy Director, Paul Foster, who also serves as the head of the National Cyber Crime Unit, described the operation as a “key step” in a complex investigation.
“Today’s charges are a key step in what has been a lengthy and complex investigation. This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure,” he said.
Increased threat from English-speaking cyber gangs
Foster also highlighted the increasing threat from English-speaking cyber gangs, such as Scattered Spider.
“Earlier this year, the NCA warned of an increase in the threat from cybercriminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example,” he added.
However, he reiterated the NCA’s commitment to bringing the perpetrators to justice by collaborating with its domestic and international law enforcement partners, such as the FBI.
“The NCA, UK policing and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice.”
The London transport authority also lauded the NCA for bringing the suspects behind the devastating cyber attack to justice.
“We welcome this announcement by the National Crime Agency that two people have now been charged in relation to the cyber incident which impacted our operations last year,” the authority said.
