Two teenagers accused of being part of Scattered Spider hacking group admit £39m cyberattack that paralysed Transport for London network

Published: 18:59, 22 June 2026 | Updated: 19:11, 22 June 2026 Two teenagers accused of being part of a hacking group called Scattered Spider have admitted a £39m cyberattack that paralysed London's transport network. Thalha Jubair, 19, and Owen Flowers, 18, hacked into Transport for London's (TfL's) system between August 29 and September 3, 2024, causing chaos for Oyster card users. Their scheme targeted key features of the TfL Go app and the TfL website, essentially locking users out of making payments onto their Oyster cards. It also meant customers could not see live Tube arrival information or their journey history on either of these sites. The attacks are believed to have cost TfL tens of millions and caused disruptions to millions of travellers. Prosecutor Alistair Richardson on Monday told Woolwich Crown Court the goal of the hacking procedure was to 'install ransomware'. Jubair and Flowers are now facing prison time after they admitted conspiring to commit unauthorised acts against computer systems belonging to TfL causing risk of serious damage to human welfare. Flowers alone also admitted hacking two US healthcare companies - SSM Health Care Corporation and Sutter Health - on the first day of what was due to be a six week trial. Thalha Jubair, pictured, was part of a hacking group called Scattered Spider and, along with Owen Flowers, has admitted a £39m cyberattack that paralysed the TfL network Pictured: Flowers. Alongside Jubair, they managed to cause chaos for Oyster card users across the capital Both hackers are members of the shadowy online criminal collective known as Scattered Spider.  Jubair was subject to a youth rehabilitation order at the time of the offences, after previously being convicted of hacking BT and EE as well as computer chip company Nvidia. He also hacked gaming firm Rockstar as it developed the latest instalment of its Grand Theft Auto series, alongside 'cyber genius' Arion Kurtaj, 20, in 2023 as members of the so-called Lapsus$ group.  The charges filed in New Jersey last September claim he took part in relation to at least 120 attacks on computer networks and extortion involving 47 US companies and organisations between May 2022 and September 2025. The Justice Department alleges victims paid at least $115m (£87m) in ransom payments. He is wanted for seven counts of fraud in the USA, which carry a maximum sentence of 95 years and may result in an extradition hearing in the future. He is also said to have targeted members of the US judiciary with threats of blackmail.  In the past couple of years, hundreds of millions of dollars worth of cryptocurrency have moved through the hacker's accounts, according to Mr Richardson.  Jubair also had a Bangladeshi passport, which was not declared to the police who eventually found the document hidden down the back of a sofa. He was also convicted of stalking two young women at a youth court and hacking into a City of London Police server. Defending Jubair, Clementine Simon said: 'He has also been subject to stringent police bail since March. 'The NCA (National Crime Agency) has been going round to his house, every single time he has supplied them with his passwords. He has been very open with them since being on bail. 'He has been learning to drive as well and all of this he has been very open with the NCA. 'His father is a careworker, his mother has given up her job to act as a full-time carer for Mr Jubair. '(He is) fearful of how other people will treat him if remanded in custody - in my submission, given his vulnerabilities, custody will have more of an effect on him than others. He is a young, vulnerable man.' Defending Flowers, Justin McLintock told an earlier hearing he was of previous good character, adding: 'Ultimately the court is presented with a young man who lives in Walsall and lives with his grandmother.' But the court heard Flowers had also directed an attack on two US healthcare providers who operate hospitals. 'The risk of harm from those offences is therefore obvious and serious, it was plain to Mr Flowers that in one of those attacks, he said in a message, it might kill some 90-year-old on life support,' Mr Richardson said.  Court sketches of Flowers, left, and Jubair, right. Their scheme targeted key features of the TfL Go app and the TfL website He told an earlier hearing that Flowers held $7.1m (£5.3m) including crypto in accounts he controlled despite having no source of income.  Flowers denied two further hacking charges and they were ordered to lie on file.  Deputy Director Paul Foster, head of the NCA's National Cyber Crime Unit, said: 'This attack caused significant disruption and millions in losses to TfL, part of the UK's critical national infrastructure.' Mr Justice Turner remanded Jubair and Flowers - who also admitted conspiring to commit unauthorised acts against computer systems belonging to SSM Health Care Corporation and attempting to commit unauthorised acts against computer systems belonging to Sutter Health - in custody ahead of a two day sentencing hearing in July. Sorry we are not currently accepting comments on this article.