Two teenagers have entered not guilty pleas in a significant cyber crime case concerning a major attack on Transport for London (TfL).
The Defendants and Charges
Thalha Jubair, aged 19, from Tower Hamlets, and Owen Flowers, aged 18, from Walsall, stand accused of conspiring to commit unauthorised acts against the capital's transport authority. The charges stem from an investigation led by the National Crime Agency (NCA) and the City of London Police, which led to their arrests in September.
Prosecutors informed Westminster Magistrates' Court that the alleged cyber assault resulted in a staggering £39 million financial loss for TfL. They also highlighted a profound "loss of livelihood" for individuals whose income depends on TfL-issued licences.
Broader Implications and Additional Charges
The court previously heard that this alleged attack posed a "significant risk" to both the UK economy and London residents. The case has drawn wider attention due to its connections to international cyber crime.
Flowers faces further charges beyond the TfL incident. He is accused of conspiring to target US healthcare firms, specifically SSM Health Care Corporation, and of attempting to commit unauthorised acts against Sutter Health. His initial arrest in connection with the TfL attack occurred in September 2024, followed by a second arrest in September 2025.
Jubair faces an additional charge under the Regulation of Investigatory Powers Act (Ripa) for allegedly failing to disclose the PIN or passwords to his electronic devices.
Link to Notorious Hacking Group and Trial Details
The NCA has stated that investigators believe the TfL cyber attack was carried out by the criminal collective known as Scattered Spider. This group has been linked to other high-profile cyber attacks on companies such as Jaguar Land Rover and retailers including Marks and Spencer.
The breach was identified by Transport for London on September 1 last year. During the attack, sensitive customer data was accessed, including:
- Names and contact information
- Oyster card refund data
- Associated bank details
Both defendants appeared at Southwark Crown Court, where they pleaded not guilty to all charges. Judge Christopher Hehir has identified a trial date of June 8, 2025. The two are next scheduled to appear at the same court on February 13 for a pre-trial review.
