Two Teenage Suspects Charged in UK Over TfL Hack
The National Crime Agency (NCA) announced on Thursday that Thalha Jubair, 19, from East London, and Owen Flowers, 18, from Walsall, had been arrested at their homes at lunchtime on Tuesday. The Crown Prosecution Service authorized charges against both men on Wednesday night under the Computer Misuse Act, alleging they conspired to commit unauthorized acts against Transport for London (TfL), which was hacked in August 2024.
Flowers had initially been arrested over the transit agency attack in September 2024, but released on bail. The NCA said its officers also discovered additional potential evidence that Flowers had been involved in attacks against U.S. healthcare companies following his arrest. Flowers faces two additional charges of conspiring with others to infiltrate and damage the networks of SSM Health Care Corporation and attempting to do the same to Sutter Health.
Additional Charges Filed Against Thalha Jubair
In related news, the U.S. Department of Justice unsealed a complaint filed in the District of New Jersey charging Thalha Jubair with conspiracies to commit computer fraud, wire fraud, and money laundering, in relation to at least 120 computer network intrusions and extortion involving 47 U.S. entities.
“Jubair is alleged to have participated in a sweeping cyber extortion scheme carried out by a group known as Scattered Spider, which committed at least 120 attacks worldwide and resulted in over $115 million in ransom payments from victims,” said Acting Assistant Attorney General Matthew R. Galeotti of the Justice Department’s Criminal Division.
U.S. Attorney Alina Habba Comments on Charges Against Jubair
“The charges against Jubair announced today are the result of a lengthy investigation into particular cyber threat actors, often referred to as Scattered Spider, who have victimized at least 47 U.S.-based entities, including in New Jersey,” said Alina Habba, Acting U.S. Attorney and Special Attorney for the District of New Jersey.
“As alleged by the complaint, Jubair went to great and sophisticated lengths to keep himself anonymous while he and his criminal associates continued to attack these victims and extort tens of millions of dollars in ransom payments. But thanks to the relentless investigation of this Office and our FBI and CCIPS partners, Jubair could not remain anonymous and avoid justice indefinitely. Today’s charges demonstrate my Office’s determination to identify cybercriminals and bring them to justice, wherever they are in the world.”
FBI Comment on Charges Against Jubair
“Today’s charges make it clear that no cybercriminal is beyond our reach,” said Assistant Director Brett Leatherman of the FBI’s Cyber Division.
“If you attack American companies or citizens, we will find you, we will expose you, and we will seek justice. The FBI continues to deploy every investigative and technical resource available to dismantle criminal cyber networks and hold their members accountable. This means working with trusted international partners like the UK’s National Crime Agency, the West Midlands Police, and the City of London Police, as well as utilizing the capabilities of our state and local partners, who are valued members of FBI’s Cyber Task Forces.”
UK Authorities Also Investigating Jubair and Flower
The United Kingdom’s National Crime Agency and the City of London Police, the United Kingdom’s West Midlands Police, the National Police of the Netherlands, the Dutch Prosecutor’s Office, the Romanian Directorate for Investigating Organized Crime and Terrorism, Brigade for Combating Organized Crime Targu Mures, Romanian National Police, Directorate for Combating Organized Crime, the Royal Canadian Mounted Police, and the Australian Federal Police have provided significant assistance.
Assistant Deputy Chief Adrienne L. Rose and Trial Attorney George S. Brown of the Justice Department’s Computer Crime and Intellectual Property Section (CCIPS) and Assistant U.S. Attorney Andrew Kogan for the District of New Jersey’s Cybercrime Unit are prosecuting the case. The Justice Department’s Office of International Affairs provided significant assistance.
CCIPS investigates and prosecutes cybercrime in coordination with domestic and international law enforcement agencies, often with assistance from the private sector. Since 2020, CCIPS has secured the conviction of over 180 cybercriminals, and court orders for the return of over $350 million in victim funds. A complaint is merely an allegation. All defendants are presumed innocent until proven guilty beyond a reasonable doubt in a court of law.