Overview

• Owen Flowers, 18, of Walsall, and Thalha Jubair, 19, of East London, were arrested on 16 September by the NCA and City of London Police and appeared at Westminster Magistrates’ Court.
• The CPS approved charges largely under the Computer Misuse Act; Jubair faces an extra count under RIPA Section 49 for allegedly refusing to disclose device PINs and passwords.
• Flowers also faces counts linked to alleged intrusions targeting US healthcare organisations SSM Health Care Corporation and Sutter Health.
• Investigators say the 31 Aug–1 Sept 2024 intrusion disrupted online services and APIs, exposed refund and bank data for roughly 5,000 Oyster users, and cost TfL tens of millions of pounds, with prosecutors telling the court losses reached £39m.
• The NCA attributes the incident to the Scattered Spider collective and says the case is part of a complex, multi‑agency probe involving UK units and the FBI.