Two teenagers have pleaded guilty to a cyber-attack that cost Transport for London (TfL) £39m.
Thalha Jubair, 19, and Owen Flowers, 18, are believed to have been part of Scattered Spider, the criminal group that carried out the “network intrusion” last summer .
The hack disrupted live Tube arrival information on the TfL Go app and the TfL website, and made online journey histories unavailable.
It left over-60s, children and students unable to apply for new discount Oyster cards until recently – forcing them to pay standard fares .
Jubair, of Bow, east London, and Flowers, of Walsall, West Midlands, both admitted conspiring to commit unauthorised acts against computer systems belonging to TfL, causing risk of serious damage to human welfare.
Flowers admitted conspiring to commit unauthorised acts against computer systems belonging to SSM Health Care Corporation and attempting to commit unauthorised acts against computer systems belonging to Sutter Health, on or Sept 6, 2024.
The two entered their guilty pleas on the first day of a trial at Woolwich Crown Court that had been expected to last six weeks.
Mr Justice Turner remanded Jubair and Flowers in custody until a two-day sentencing hearing that will begin on July 15.
Alistair Richardson, prosecuting, said earlier that the object of the “highly sophisticated” attack on TfL had been to install ransomware.
He said Flowers alone had directed an attack against two healthcare providers running hospitals in the US, adding: “The risk of harm from those offences is therefore obvious and serious.”
He claimed the risks had been “plain to Mr Flowers” who had said in a message that one of the attacks “might kill some 90-year-old on life support”.
Mr Richardson told an earlier hearing that Flowers held $7.1m (£5.4m) including crypto in accounts he controlled despite having no source of income.
Jubair’s 22 prior convictions include 13 counts of fraud, two of unauthorised access to a computer, one count of obtaining access to a computer and one count of blackmail.
He was subject to a youth rehabilitation order at the time of the TfL offences, after being convicted at 17 of hacking BT and EE, the telecoms firms, and Nvidia, the computer chip maker.
Both defendants have been diagnosed with autism and Jubair suffers from depression and a severe mood disorder.
Defending Flowers, Justin McLintock told an earlier hearing he was of good character, adding: “Ultimately the court is presented with a young man who lives in Walsall and lives with his grandmother.”
Defending Jubair, Clementine Simon said her client was a “young, vulnerable man”, adding: “He does have autism and he rarely goes out – this, in my submission, is not someone who represents a flight risk.”
Paul Foster, deputy director of the National Crime Agency (NCA) and head of its cybercrime unit, previously said: “This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure.
“Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example.
“The NCA, UK policing and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice.”
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
