Two teenagers have been arrested in the UK over a cyber attack that hit Transport for London (TfL) last year and caused millions of pounds in disruption.
The National Crime Agency (NCA) said the pair were suspected members of the Scattered Spider hacking group, which has been linked to dozens of attacks on businesses and public services in the UK and US.
Arrests in London and Walsall
Thalha Jubair, 19, from East London, and Owen Flowers, 18, from Walsall in the West Midlands, were detained at their home addresses earlier this week.
Both are accused of being involved in the attack on TfL in August 2024. The hack forced parts of the capital’s transport network offline and led to what investigators described as “millions in losses”.
Flowers was first arrested over the case last September but released on bail. The NCA said new evidence shows he also tried to break into US healthcare companies, including SSM Health and Sutter Health.
Jubair has separately been charged under the UK’s Regulation of Investigatory Powers Act for refusing to give investigators the passwords to devices seized earlier this year.
‘Millions in Losses’
Paul Foster, deputy director of the NCA’s National Cyber Crime Unit, said the scale of the TfL attack underlined the threat posed by Scattered Spider.
“This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure,” he said. “Scattered Spider is a clear example of the rise in cyber criminals operating out of the UK and other English-speaking countries.”
US Charges
At the same time as the UK arrests, prosecutors in the US unsealed a case against Jubair. He is accused of taking part in more than 120 cyber intrusions between 2022 and 2025 and of attempting to extort 47 organisations.
Court documents say the group tricked staff into handing over access details, then stole or encrypted data and demanded ransom. Victims are said to have paid at least $115m (£92m) to regain control or stop stolen material being leaked.
In July 2024, US investigators seized cryptocurrency wallets linked to Jubair, recovering digital assets worth about $36m (£29m). He is also alleged to have moved $8.4m (£6.4m) of ransom proceeds into another account.
Facing 95 Years
Jubair has been charged in the US with computer fraud, wire fraud and money laundering. If convicted on all counts, he faces a maximum sentence of 95 years.
Alina Habba, Acting US Attorney for the District of New Jersey, said Jubair “went to great lengths to remain anonymous while he and his associates attacked victims and extorted tens of millions of dollars”.
What Happens Next
Both teenagers remain under investigation in the UK. The NCA said it was working closely with American authorities, raising the possibility of extradition proceedings.
The case highlights the global reach of cyber groups such as Scattered Spider, whose attacks have hit businesses, healthcare providers and public infrastructure on both sides of the Atlantic.
