London, November 23, 2025
Two British teenagers, Thalha Jubair (19) and Owen Flowers (18), pleaded not guilty today at Southwark Crown Court in London to charges linked to a major 2024 cyberattack on Transport for London (TfL), which caused extensive financial and operational damage.
Charges and Cyberattack Impact
The defendants face accusations related to a significant cyberattack attributed to the hacking group known as Scattered Spider. The August 2024 attack resulted in approximately £39 million in damages and disrupted TfL’s online services for three months. Although physical transportation operations remained unaffected, critical digital services—including real-time information boards, traffic cameras, “dial a ride” booking systems, and certain payment platforms—were rendered inoperative.
The breach also led to unauthorized access to personal data, such as customer names, email addresses, home addresses, and possibly bank account numbers and sort codes. TfL issued notifications to thousands of affected customers following the data breach.
Defendants and Legal Proceedings
Alongside these charges, Owen Flowers is also accused of unauthorized access to healthcare computer systems including the SSM Health and Sutter Health networks. Meanwhile, Thalha Jubair faces additional allegations of withholding passwords for devices seized during the investigation and is subject to separate charges in the United States.
Both Jubair and Flowers appeared in court to confirm their identities and entered pleas of not guilty. They refrained from making further comments during the hearing. Currently, both defendants remain in custody awaiting trial. The court has provisionally scheduled the trial to commence on June 8, 2026, with a pre-trial hearing set for February 13.
Broader Context and Significance
This case underscores growing concerns about the vulnerabilities of critical urban infrastructure to cyber threats and the substantial societal impact of criminal hacking groups with apparent state-level sophistication. It represents part of international initiatives to bring cybercriminals to justice, particularly those targeting essential public services.
As legal proceedings advance, this high-profile prosecution will be closely watched by cybersecurity experts, policymakers, and global stakeholders interested in safeguarding critical infrastructure and enhancing digital security resilience.