Two teenagers suspected of orchestrating the devastating August 2024 cyberattack on Transport for London (TfL) have been arrested by UK authorities. The suspects, identified as 18-year-old Owen Flowers from Walsall and 19-year-old Thalha Jubair from East London, are believed to be members of the notorious Scattered Spider hacking group.
## The Arrests and Charges
Both suspects appeared at Westminster Magistrates Court facing computer misuse and fraud charges related to the TfL breach. Flowers, who was previously arrested in September 2024 and released on bail, now faces additional charges for allegedly conspiring to attack major US healthcare networks, including SSM Health Care Corporation and Sutter Health.
The case has taken on international dimensions, with the US Department of Justice filing separate charges against Jubair. He faces conspiracy charges for computer fraud, money laundering, and wire fraud related to at least 120 network breaches worldwide between May 2022 and September 2025. These attacks reportedly affected 47 US organizations and generated over $115 million in ransom payments.
## The Transport for London Attack
TfL initially disclosed the cyberattack in September 2024, claiming no customer data was compromised. However, the organization later revealed that customer information, including names, contact details, and addresses, had indeed been stolen during the breach.
While London’s transportation services continued operating normally, the attack significantly disrupted internal systems, online services, and TfL’s ability to process customer refunds. The incident affected the transportation network that serves over 8.4 million Londoners daily through underground, surface, and Crossrail systems.
## Growing Cyber Threat
“This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure,” stated Deputy Director Paul Foster of the National Crime Agency’s National Cyber Crime Unit. He emphasized that Scattered Spider represents a clear example of the increasing cyber threat from English-speaking countries.
This isn’t TfL’s first security incident. In May 2023, the Clop ransomware gang compromised data from over 13,000 customers through a supplier’s file transfer system.
## Broader Investigation
The arrests are part of a larger crackdown on the Scattered Spider collective. In July, UK authorities arrested four other suspected members believed to be involved in cyberattacks against major British retailers, including Marks & Spencer, Harrods, and Co-op.
These arrests highlight the growing sophistication of cybercriminal groups and the international cooperation required to combat them, as authorities work to protect critical infrastructure from increasingly bold and damaging cyberattacks.