Two men have been charged as part of the National Crime Agency investigation into a cyber attack on Transport for London (TfL).
TfL was subject of a network intrusion on 31 August 2024, which investigators believe was carried out by members of the online criminal collective known as Scattered Spider.
Thalha Jubair, 19, from East London, and Owen Flowers, 18, from Walsall, West Midlands, were arrested at their home addresses on Tuesday (16 September) by the NCA and City of London Police.
Both will appear at Westminster Magistrates Court today (18 September), after the Crown Prosecution Service authorised they be charged with conspiring together to commit unauthorised acts against TfL, under the Computer Misuse Act.
Flowers was initially arrested for the TfL attack on 6 September 2024, at which point NCA officers identified further potential evidence of offending against US healthcare companies.
Therefore, Flowers has today also been charged with conspiring with others to infiltrate and damage the networks of SSM Health Care Corporation and attempting to do the same to Sutter Health’s networks, both based in the US.
Jubair has been additionally charged under RIPA for failing to disclose the pin or passwords for devices seized from him.
Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said:
“Today’s charges are a key step in what has been a lengthy and complex investigation.
“This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure.
“Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example.
“The NCA, UK policing and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice.”
The NCA investigation has also been supported by the West Midlands Regional Organised Crime Unit and British Transport Police.
Hannah Von Dadelszen, Chief Crown Prosecutor for the Crown Prosecution Service, said:
“The Crown Prosecution Service has decided to prosecute Thalha Jubair and Owen Flowers with computer misuse and fraud related charges – following a National Crime Agency investigation into a cyber-attack on the Transport for London network.
“Our prosecutors have worked to establish that there is sufficient evidence to bring the case to trial and that it is in the public interest to pursue criminal proceedings.
“We have worked closely with the National Crime Agency as they carried out their investigation.”
Victims of cybercrime should use the Government’s Cyber Incident Signposting Site for direction on which agencies to report an incident to.
The Cyber Choices programme helps people make informed choices to use their cyber skills in a legal way. Visit www.cyberchoices.uk.
18 September 2025
Read More NCA |National Crime Agency