Teenagers charged over cyber attack on TFL costing millions of pounds

Two teenagers have been charged in connection with a cyber attack on Transport for London (TfL) costing millions of pounds.

Investigators believe the "network intrusion" last summer was carried out by the online criminal group known as Scattered Spider.

Thalha Jubair, 19, from east London, and Owen Flowers, 18, from Walsall in the West Midlands, were arrested on Tuesday at their homes.

They were detained as part of an operation by officers from the National Crime Agency (NCA) and City of London Police.

Both are due to appear at Westminster Magistrates on Thursday charged with conspiring together to commit unauthorised acts against TfL, under the Computer Misuse Act.

TfL was targeted on 31 August 2024 by attackers who accessed customer data including names and contact details.

The cyber incident did not cause any wider disruption to transport networks but has cost the operator millions of pounds in losses and recovery.

At the time, TfL described the attack as "sophisticated" and "aggressive" and were forced to shut down some areas of operation including traffic cameras, and "dial-a-ride" bookings.

They were also unable to process some payments.

Flowers was first arrested on 6 September 2024 and has also been accused of potential offending against US healthcare companies and charged with conspiring to infiltrate and damage the networks of SSM Health Care Corporation and attempting to do the same to Sutter Health's networks.

Jubair has been additionally charged for failing to disclose the pin or passwords for devices seized from him.

Deputy director Paul Foster, head of the NCA's Cyber Crime Unit, described the charges as a "key step" in a "lengthy and complex investigation".

"This attack caused significant disruption and millions in losses to TfL, part of the UK's critical national infrastructure," he added.

"Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example.

"The NCA, UK policing and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice."

He also thanked TfL for its "swift action" in reporting the cyber attack and its "engagement" with the NCA on the investigation.

Read more from Sky News:
Donald Trump historic state visit - second day in pictures
Russian forces create 'kill zone' around crucial Ukrainian city

Scattered Spider is a notorious hacking network which has been linked with large scale attacks on three well known retailers in the UK this year.

M&S was targeted by cyber criminals in April - in an attack that caused disruption lasting months.

The British retailer halted online orders, was unable to process contactless payments and shelves were empty in shops.

It is estimated that the cyber attack will cost M&S up to £300m this year.

Days after M&S was targeted, the Co-op was attacked and forced to shut down some internal systems.

Luxury retailer Harrods was affected and had to shut down some systems despite its website and shops continuing to operate.

The NCA investigation has also involved support from the West Midlands Regional Organised Crime Unit and British Transport Police.

(c) Sky News 2025: Teenagers charged over cyber attack on TFL costing millions of pounds