Two Young Men Plead Guilty in TfL Hack Causing £39 Million

Two young men have pleaded guilty to carrying out a major cyberattack on Transport for London in 2024, an intrusion that caused months of disruption, exposed the data of millions of customers, and resulted in tens of millions of pounds in losses. Thalha Jubair, 20, from east London, and Owen Flowers, 18, from Walsall, admitted to conspiring to commit unauthorized acts against TfL's computer systems at Woolwich Crown Court on Monday, June 22, 2026, on what was to have been the first day of their six-week trial.

The defendants, identified by the National Crime Agency as members of the cybercrime collective Scattered Spider, infiltrated TfL's network between late August and early September 2024. The attack forced all 28,000 TfL employees to reset their passwords in person, caused widespread operational issues, and compromised the Oyster card refund system. Customer refunds were delayed, and the application system for discounted Oyster photocards for children and young people was shut down. The NCA stated the incident caused an estimated £29 million to £39 million in losses and recovery costs for the transport authority.

Investigators searching Flowers's home after his initial...