A Black Country teenager who hacked Transport for London (TfL) - causing tens of millions of pounds in losses and disruption for thousands of customers - is due to be sentenced at court.
Owen Flowers, aged 18, from Walsall , launched the cyber attack against TfL's network and systems alongside 20-year-old Thalha Jubair between August 31 and September 6, 2024.
The pair comprised the company's network, forcing all 28,000 employees to attend their office for a password reset.
Get breaking news on BirminghamLive WhatsApp , click the link to join
TfL reportedly suffered £29 million in losses and recovery costs as a result of the incident.
Meanwhile, data from TfL’s Oyster refunds system was accessed.
And due to the transport company's refund system being affected, some customers were out of pocket for much longer than usual.
The cyber attack further caused the application system for Oyster photocards for children and young people to close down.
Flowers was initially arrested in connection with the TfL attack on September 6 that same year.
Officers from the UK's National Crime Agency (NCA) then found further evidence that the networks of two US healthcare companies, called SSM Health Care Corporation and Sutter Health, had been infiltrated and damaged.
A number of devices were found at Flowers' address including laptops, tower computers, hard drives and USB sticks.
That included an Acer laptop which contained a screen shot showing network connectivity to TfL infrastructure.
Flowers had also accessed an online tool selling breached credentials.
The laptop further contained a number of videos that Flowers had recorded, showing Jubair accessing TfL systems during the attack.
The pair - who were part of an online criminal collective known as 'Scattered Spider' - had messaged each other over Telegram at the same time.
They'd also communicated via an online tool where multiple participants can work remotely on a common workspace.
Flowers was bailed with strict conditions, which he breached on two occasions in March 2025 and May 2025.
The NCA said Flowers, alongside Jubair, were arrested at their addresses on September 16 last year by the NCA and City Of London Police.
Both men were charged with conspiracy to commit unauthorised acts in relation to a computer, causing or creating risk of, serious damage, contrary to section one of the Criminal Law Act 1977.
Flowers faced two additional charges, which were:
Jubair faced an additional charge, which was:
Both individuals were due to stand trial at Woolwich Crown Court today, June 22, but changed their pleas to guilty on the first day of proceedings.
They are due to be sentenced at the same court on July 16.
Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said: "This has been a lengthy, highly complex and painstaking investigation.
"The perseverance and meticulousness of our officers, and the work of our partner organisations, meant that Jubair and Flowers had no option other than to plead guilty and take responsibility for their offending.
"Cyber crime may appear faceless and distant compared to other crime types, but the infiltration of TfL’s systems shows it has real-world consequences and impacts hugely on the public.
"The attack caused millions of pounds in losses to a key part of the UK’s critical national infrastructure, and was a significant inconvenience for customers.
"Today’s result would not have been possible if TfL had not engaged with law enforcement early, so I would urge any other organisation to please do the same in such circumstances.
"The profile of offenders like Flowers and Jubair demonstrates the increasing threat from cyber criminals based in the UK and other English-speaking countries, epitomised by Scattered Spider.
"This is why we work closely with partners at and abroad to identify offenders within these networks and bring them to justice."
Deputy Commissioner Nik Adams, of the City of London Police said: "The cyber attack on Transport for London had a significant and far-reaching impact, causing major disruption and affecting the day-to-day operations of essential public services.
"Those who target critical organisations, cause substantial financial harm, and disrupt the daily lives of the public will not do so without consequence.
"As the national lead force for fraud and economic crime, we have been absolutely clear in our message: we will work around the clock with our partners and stakeholders to ensure the UK remains a hostile environment for cyber criminals.
"From the outset, we have worked tirelessly alongside the National Crime Agency on what has been a lengthy and highly complex investigation. Today’s outcome is the result of that close partnership, and it demonstrates the power of joint working between law enforcement agencies to pursue those who seek to undermine the systems that keep our country running."
The NCA and COLP investigation was supported by the West Midlands Regional Organised Crime Unit and British Transport Police.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
