UK Arrests ‘Scattered Spider’ Teens Over TfL Hack
- two teenagers, believed to be linked to the August 2024 cyberattack on Transport for London, have been arrested in the United Kingdom.
- Believed to be members of the notorious Scattered Spider hacking collective, 18-year-old Owen Flowers from Walsall and 19-year-old Thalha Jubair from east London are scheduled to appear at...
- Flowers was previously arrested for his alleged involvement in the TfL attack in September 2024, but was released on bail after being questioned by officers of the UK...
Teenagers Arrested in Connection with Transport for London Cyberattack & Wider Scattered Spider Activity
two teenagers, believed to be linked to the August 2024 cyberattack on Transport for London, have been arrested in the United Kingdom.
Believed to be members of the notorious Scattered Spider hacking collective, 18-year-old Owen Flowers from Walsall and 19-year-old Thalha Jubair from east London are scheduled to appear at Westminster Magistrates Court today.
Flowers was previously arrested for his alleged involvement in the TfL attack in September 2024, but was released on bail after being questioned by officers of the UK National Crime Agency.
Since then, NCA investigators have found additional evidence possibly linking Flowers to attacks against U.S. healthcare companies.
The two suspects are being prosecuted for computer misuse and fraud-related charges linked to an examination into the breach of London’s public transportation agency. Additionally, flowers faces charges for conspiring to attack the networks of SSM Health care Corporation and Sutter Health in the United States.
“This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure,” said Deputy Director Paul Foster, the head of the NCA’s national Cyber Crime unit.
“Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example.”
The U.S. Department of Justice also today announced charges against Jubair and Flowers with conspiracies to commit computer fraud, money laundering, and wire fraud, in relation to at least 120 network breaches and extortion attacks worldwide between May 2022 and september 2025, which affected at least 47 U.S. organizations.
The complaint filed in the District of New Jersey and unsealed today, alleges that victims have paid Jubair and his accomplices at least $115,000,000 in ransom payments.
The transport for London cyberattack
tfl disclosed the August 2024 cyberattack on September 1st, 2024. The incident involved unauthorized access to their IT systems