Men admit £39m cyber attack on Transport for London

Two men have admitted carrying out a cyber attack which cost Transport for London (TfL) an estimated £39m.

Thalha Jubair, 20, and Owen Flowers, 18, initially denied responsibility but changed their pleas just as the trial was set to start on Monday.

The National Crime Agency (NCA) said both men were part of online criminal collective Scattered Spider - a group also linked to attacks on firms such as M&S.

The hackers caused multiple problems when they infiltrated TfL's network between 31 August and 3 September 2024.

At the time, the company described the attack as "sophisticated" and "aggressive" and was forced to suspend functions including traffic cameras and Dial-a-Ride bookings.

The pair accessed Oyster card data, which affected customer refunds, and closed down the system for young people's travel photocards.

All 28,000 TfL staff also had to go to the office to reset their password.

"The attack caused millions of pounds in losses to a key part of the UK's critical national infrastructure, and was a significant inconvenience for customers," said NCA deputy director Paul Foster.

"The profile of offenders like Flowers and Jubair demonstrates the increasing threat from cyber criminals based in the UK and other English-speaking countries, epitomised by Scattered Spider."

Read more:
Second boy charged with murdering 17-year-old
Former SNP chief jailed for £400,000 embezzlement

The agency said evidence included a screenshot showing connectivity to TfL infrastructure on Flowers' laptop, as well as videos of Jubair accessing the company's systems.

Flowers, from Walsall, also pleaded guilty to targeting US firms SSM Health Care Corporation and Sutter Health.

Both men well be sentenced at Woolwich Crown Court on 16 July.

(c) Sky News 2026: Men admit £39m cyber attack on Transport for London