Owen Flowers, an 18-year-old from Walsall, and his co-defendant Thalha Jubair, 20, from Tower Hamlets, east London, are due to be sentenced at Woolwich Crown Court on Wednesday, July 15, for their roles in a £39 million cyber attack on Transport for London (TfL). The pair, members of the hacking group Scattered Spider, pleaded guilty to conspiracy to commit unauthorised acts under the Computer Misuse Act, after initially denying the charges.
Impact of the Attack
The National Crime Agency (NCA) stated that the attack caused significant disruption. All of TfL's approximately 28,000 employees were forced to physically visit an office to reset their passwords. The hack also compromised the Oyster refund system, leading to delays in refunds for some customers and the temporary suspension of applications for Oyster photocards for children and young people.
The total financial loss from the attack is estimated at £39 million, covering costs related to system recovery, security upgrades, and operational downtime.
Scattered Spider's Wider Activities
Scattered Spider has been linked to other high-profile cyber attacks, including those on Jaguar Land Rover and retailers such as Marks and Spencer, according to the NCA. Flowers was first arrested in September 2024 and again in September 2025. Investigators seized a range of electronic devices from his home, including laptops, computers, hard drives, and USB sticks. One laptop contained a screenshot showing connectivity to TfL's infrastructure, and there was evidence he accessed an online tool selling exposed user login details.
Officers also discovered videos recorded by Flowers showing Jubair accessing TfL systems during the attack. The defendants communicated via Telegram and collaborated through a shared online workspace.
Legal Proceedings
Flowers and Jubair admitted conspiring to commit unauthorised acts between August 29 and September 6, 2024, just before their trial was due to start in June. Flowers also admitted targeting US healthcare firms, conspiring with others to commit unauthorised acts against SSM Health Care Corporation and attempting to commit unauthorised acts against Sutter Health. Jubair faced an additional charge under the Regulation of Investigatory Powers Act for failing to disclose the PIN or passwords of his devices, but that charge was left to lie on the file.
The sentencing hearing is listed for two days, and both defendants face possible jail time.
