Two men plead guilty over £39m TfL cyber attack that caused months of disruption

Two men have pleaded guilty to offences in connection with a massive cyber attack which caused Transport for London (TfL) months of disruption and cost the operator £39m.

Thalha Jubair, 20, from east London and Owen Flowers, 18 from Walsall in the West Midlands changed their pleas on what was expected to be the first day of a six-week trial at Woolwich Crown Court on Monday.

The pair admitted to charges of conspiring to commit unauthorised acts against TfL under the Computer Misuse Act.

TfL previously said the hack disrupted services for three months when it began on 31 August 2024. The BBC was told the breach affected 10m customers.

They both pleaded guilty on the basis they recklessly accessed the systems without intending to do so.

Flowers also pleaded guilty of attempting to hack computer systems belonging to California-based Sutter Health and another US company, SSM Healthcare Corporation.

The transport operator’s online services were impacted and customers were unable to see some information boards because they went offline during the attack.

TfL wrote to thousands of customers to tell them about the unauthorised access to some personal information.

At the time of Flowers and Jubair’s arrests, investigators from the National Crime Agency (NCA) said they believed the “network intrusion” in summer 2024 was carried out by the online criminal group known as Scattered Spider.

Speaking after the guilty pleas had been entered, Judge Mr Justice Turner thanked all the legal representatives, expressing gratitude for the “hard work” that had enabled the court to find a “satisfactory way forward”.

The two men will be sentenced on 15 July.

Listen to the best of BBC Radio London on Sounds and follow BBC London on Facebook, X and Instagram. Send your story ideas to hello.bbclondon@bbc.co.uk