Teenagers claim to be innocent in Transport for London cyberattack

Thalha Jubair (19) and Owen Flowers (18) have denied involvement in the Transport for London (TfL) data breach that occurred in August 2024, resulting in millions of pounds in damages and exposing sensitive customer data.

In September 2024, TfL disclosed that it had been hit by a cyberattack. During the attack, customer data was stolen, including full names, contact information, and postal addresses. Information about Oyster card refunds for 5,000 people, including account information, was also obtained.

The ransomware group Scattered Spider was held responsible for the cyberattack on London’s public transportation. Shortly after the attack, the then 17-year-old Owen Flowers was arrested by British authorities. Around the same time, Thalha Jubair was also apprehended by the London police.

“Attacks on public infrastructure such as this can be hugely disruptive and lead to severe consequences for local communities and national systems. This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure,” Paul Foster, Head of the UK’s National Crime Agency (NCA), said in a statement after the arrests.

Both men are being charged with conspiring to commit unauthorized acts against the TfL, as dictated in the Computer Misuse Act. As part of that charge, they are accused of “causing, or creating a significant risk of, serious damage to human welfare and intending to cause such damage or being reckless as to whether such damage was caused.”

According to Sky News, both teenagers have pleaded not guilty regarding the cyberattack on Transport for London. The news outlet reports that both suspects stood in the dock together and only spoke to confirm their names and enter pleas of not guilty.

Flowers has also been accused of conspiring to infiltrate and damage the IT networks of SSM Health Care Corporation and Sutter Health, two major healthcare providers in the United States.

Jubair is separately charged with conspiracy to commit computer fraud, money laundering, wire fraud, and failing to disclose the PIN or passwords seized from him on March 19th, 2025.

A provisional trial date has been set for June 8th, 2026, at Southwark Crown Court, with a pre-trial hearing on February 13th.