Lead

Two British men have pleaded guilty to offences connected to a 2024 cyber-attack on Transport for London (TfL) that cost £39m and affected 10 million people. Thalha Jubair, 20, of Bow, east London, and Owen Flowers, 18, of Walsall, West Midlands, entered their pleas at Woolwich crown court on Monday, the first day of what was due to be a six-week trial.

Both admitted conspiring to commit unauthorised acts against computer systems belonging to TfL, causing risk of serious damage to human welfare. Flowers separately admitted hacking two US healthcare companies.

Coverage comparison

Reporting on the case has differed in focus. The Guardian's coverage concentrated on the guilty pleas and the impact of the attack on TfL, detailing how the disruption affected live tube arrival information, the TfL Go app, and payment systems for Oyster and contactless services. The Guardian also noted that the National Crime Agency (NCA) believed the attack was carried out by an online hacking community known as Scattered Spider.

The BBC's coverage, meanwhile, centred on the arrest and charges against a teenager in the US in a related but separate case, while also referencing the earlier guilty pleas. The BBC report said the charges against Peter Stokes came after two men pleaded guilty to offences connected to the TfL attack, which the NCA believed was conducted by the same group.

Key claims

  • Guilty pleas: Jubair and Flowers both admitted conspiring to commit unauthorised acts against TfL computer systems, according to The Guardian. Flowers also admitted hacking two US healthcare companies—SSM Health Care Corporation and Sutter Health—on or about 6 September 2024, as reported by The Guardian.
  • Scale of the attack: The 2024 cyber-attack cost £39m and affected 10 million people, The Guardian reported. The BBC also reported that around 10 million people's data was stolen in the attack. The Guardian noted that TfL emailed more than 7 million customers in September 2024 to inform them about the incident and that some customer data may have been taken.
  • Attribution: The National Crime Agency said it believed the attack was carried out by Scattered Spider, a hacking group suspected of a series of attacks in recent years, both The Guardian and the BBC reported. The BBC added that the NCA considered Scattered Spider a key part of its investigation into cyber attacks on British retailers Co-op and M&S last year.
  • US case: Peter Stokes, 19, a dual US-Estonian national, was arrested in Finland in April and extradited to the US following an Interpol Red Notice, the BBC reported, citing the US Department of Justice (DoJ). He has been charged with computer intrusion, conspiracy and fraud. The complaint alleges that he and other co-conspirators made a ransom demand of around $8m in cryptocurrency to a luxury jewellery retailer after stealing its data last year; no ransom was paid, but the company lost at least $2m due to business disruption, investigation and mitigation, the DoJ said.
  • Scattered Spider's activities: The DoJ said Scattered Spider has been involved in hacks resulting in more than $100m (£75m) in ransom payments, the BBC reported. The group's members are thought to be young, native English speakers from the US and UK, according to the NCA, as reported by the BBC.

Sentencing

Justice Turner remanded Jubair and Flowers in custody ahead of a two-day sentencing hearing on 15 July, The Guardian reported.

Stokes appeared in federal court in Chicago on Tuesday and was ordered to remain in custody, according to the BBC. The FBI—working in Copenhagen and Chicago—and Finland's National Bureau of Investigation worked on the operation, the DoJ said.