Overview
- The defendants, Thalha Jubair and Owen Flowers, pleaded guilty on Monday to conspiring to carry out an unauthorised attack on Transport for London that investigators say caused around £39 million in losses.
- Authorities say the breach took place between late August and early September 2024 and forced 28,000 TfL staff to reset passwords while delaying Oyster refunds and closing some photocard applications.
- Investigators seized laptops, hard drives and videos that prosecutors say show direct access to TfL systems plus messages and a shared workspace used during the intrusion.
- Flowers also admitted offences against two U.S. health organisations, and separate U.S. indictments linked to the broader Scattered Spider activity remain part of the case.
- The pair will be sentenced at Woolwich Crown Court on July 15 and 16, and law enforcement officials said the case underlines growing threats to critical infrastructure and the need for early reporting to police.