British Hackers Plead Guilty to £39m Transport for London Cyber Attack

In a significant development, two British cybercriminals have admitted to carrying out a devastating cyber attack on Transport for London (TfL) in 2024, which resulted in a staggering £39m loss and affected around 10 million people. Thalha Jubair, 20, and Owen Flowers, 18, members of the notorious Scattered Spider hacking group, pleaded guilty to offences under the Computer Misuse Act at Woolwich Crown Court. The attack, which occurred in 2024, had far-reaching consequences, including the theft of customer data and disruption to TfL's services, including the failure of live tube arrival information to appear on the TfL Go app and website. The organisation was also unable to process payments on the Oyster and contactless apps, causing significant inconvenience to commuters. According to the National Crime Agency (NCA), the hackers accessed TfL's refunds system, leaving some customers out of pocket for an extended period. The attack also shut down the application system for Oyster photocards for children and young people. The NCA's head of national cyber crime unit, Paul Foster, highlighted the growing threat from homegrown and English-speaking hackers, citing the Scattered Spider group as a prime example. The case underscores the real-world consequences of cybercrime, which can have a profound impact on the public. Jubair and Flowers will face sentencing on July 15, following a two-day hearing. The guilty pleas mark a significant milestone in the investigation, which has shed light on the activities of the Scattered Spider group and the increasing threat posed by cybercriminals based in the UK and other English-speaking countries.