Owen Flowers, an 18-year-old from Walsall in the Black Country, has admitted to orchestrating a cyber attack on Transport for London (TfL) that caused tens of millions of pounds in losses and disrupted thousands of customers. Flowers, alongside 20-year-old Thalha Jubair, infiltrated TfL's network and systems between August 31 and September 6, 2024, forcing all 28,000 employees to attend their offices for a password reset. The attack resulted in approximately £29 million in losses and recovery costs for TfL, according to the National Crime Agency (NCA).
Details of the Cyber Attack
The hackers accessed data from TfL's Oyster refunds system, causing delays for customers seeking refunds. The attack also forced the closure of the application system for Oyster photocards for children and young people, further inconveniencing the public. Flowers was initially arrested on September 6, 2024, in connection with the TfL breach. During a search of his address, NCA officers seized laptops, tower computers, hard drives, and USB sticks, including an Acer laptop containing a screenshot showing network connectivity to TfL infrastructure. Flowers had also accessed an online tool selling breached credentials.
Links to US Healthcare Companies
Further investigation revealed that Flowers and Jubair had infiltrated the networks of two US healthcare companies: SSM Health Care Corporation and Sutter Health. The NCA found evidence that these networks had been damaged, though the full extent of the impact on patient data or operations has not been disclosed. The pair were part of an online criminal collective known as 'Scattered Spider', which the NCA describes as a growing threat from cyber criminals based in the UK and other English-speaking countries.
Arrests and Charges
Flowers and Jubair were arrested at their home addresses on September 16, 2024, by the NCA and City of London Police. Both were charged with conspiracy to commit unauthorised acts in relation to a computer, causing or creating risk of serious damage, contrary to section one of the Criminal Law Act 1977. Flowers faced two additional charges: conspiracy to commit unauthorised acts with intent to impair, and attempting to commit unauthorised acts with intent to impair. Jubair faced an additional charge of failing to disclose the pin or passwords for devices seized from him.
Guilty Pleas and Sentencing
The pair were due to stand trial at Woolwich Crown Court on June 22, 2026, but changed their pleas to guilty on the first day of proceedings. They are scheduled to be sentenced at the same court on July 16, 2026. Flowers had been bailed with strict conditions but breached them on two occasions in March and May 2025.
Impact and Law Enforcement Response
Deputy Director Paul Foster, head of the NCA's National Cyber Crime Unit, said: "This has been a lengthy, highly complex and painstaking investigation. The perseverance and meticulousness of our officers, and the work of our partner organisations, meant that Jubair and Flowers had no option other than to plead guilty and take responsibility for their offending." He added: "Cyber crime may appear faceless and distant compared to other crime types, but the infiltration of TfL's systems shows it has real-world consequences and impacts hugely on the public. The attack caused millions of pounds in losses to a key part of the UK's critical national infrastructure, and was a significant inconvenience for customers."
Partnership Working
Deputy Commissioner Nik Adams of the City of London Police said: "The cyber attack on Transport for London had a significant and far-reaching impact, causing major disruption and affecting the day-to-day operations of essential public services. Those who target critical organisations, cause substantial financial harm, and disrupt the daily lives of the public will not do so without consequence." The investigation was supported by the West Midlands Regional Organised Crime Unit and British Transport Police. The NCA has urged other organisations to engage with law enforcement early in the event of a cyber attack.
