Two teenagers in the UK have been charged over a cyber attack that hit Transport for London. The hack caused months of disruption and ran up costs in the tens of millions. Investigators say the pair are linked to Scattered Spider, a group already blamed for major ransomware and extortion cases around the world.
Police arrested Thalha Jubair, 19, from east London, and Owen Flowers, 18, from Walsall during raids on Tuesday. The National Crime Agency worked with City of London Police in the operation. On Thursday, both teenagers were brought before Westminster Magistrates Court.
They are accused of conspiring together to commit unauthorised acts under the UK’s Computer Misuse Act. The charges stem from an attack that began on 31 August last year and continued to affect TfL’s operations for months.
One of the biggest concerns was data theft. TfL informed about 5,000 customers that hackers may have looked at their details. That included names, emails, and home addresses. Some financial data, like bank account numbers and sort codes, may also have been exposed.
Scattered Spider is known for using social engineering techniques. Members call or message staff, pretending to be insiders, and then grab login details. With those credentials, they slip into networks, lock up or steal files, and demand ransom.
Scattered Spider has been linked to at least 120 intrusions targeting over 47 U.S. organizations, including healthcare providers, courts, and critical infrastructure. According to the U.S. Department of Justice (DOJ), the group collected more than $115 million in ransom payments.
The NCA says the arrest of Jubair and Flowers is part of a much broader investigation into this cyber-criminal network. Charges Against Jubair Court filings in the United States show that Thalha Jubair is accused of far more than just the TfL case.
U.S. prosecutors say he operated online under names like “EarthtoStar,” “Brad,” “Austin,” and “@autistic.” From May 2022 to September 2025, he and others allegedly broke into dozens of networks.
At one point in July 2024, when law enforcement seized a server linked to the group, officers found $36 million in cryptocurrency. Jubair allegedly tried to move another $8.4 million linked to victims into different wallets at the same time.
U.S. prosecutors have filed several charges against Jubair, including computer fraud, wire fraud, and money laundering. In total, he faces seven counts. If a court convicts him on all charges, he could be sentenced to as much as 95 years in prison.
