Two men including one from Walsall admit carrying out cyber attack on Transport for London
They'll be sentenced next month
Two young men have pleaded guilty to carrying out a cyber attack on Transport for London (TfL).
Thalha Jubair, 20, and Owen Flowers, 18, were arrested in September last year as part of an investigation by the National Crime Agency and City of London Police.
Prosecutors said the cyber attack resulted in a £39 million loss for TfL as well as a “loss of livelihood” for people dependent on TfL licences, Westminster Magistrates’ Court previously heard.
They had denied conspiring together to commit unauthorised acts against TfL between August 29 2024 and September 6 2024, but changed their pleas at Woolwich Crown Court on Monday, before their trial was due to begin.
The attack posed “significant risk” to the UK economy and London residents, prosecutors said previously.
The NCA previously said investigators believe the TfL cyber attack was carried out by the criminal hacking collective known as Scattered Spider, which has been linked to other cyber attacks on Jaguar Land Rover and retailers including Marks and Spencer.
TfL identified there had been a cyber attack on September 1 2024, in which customer details including names, contact information and Oyster card refund data including bank details, were accessed.
Flowers, of Walsall, West Midlands, who was first arrested over the TfL attack in September 2024 and then arrested again in September last year, also admitted targeting US healthcare firms.
He pleaded guilty to conspiring with others to commit unauthorised acts against SSM Health Care Corporation and attempting to commit unauthorised acts against Sutter Health.
Jubair, from Tower Hamlets, east London, faced an additional charge under the Regulation of Investigatory Powers Act of failing to disclose the Pin or passwords of his devices but that was left to lie on the file.
The pair will be sentenced at the same court on July 15 and 16.