The London teenager charged in relation to a cyber attack on Transport for London that cost it more than £30m also faces prosecution in the US for a huge number of similar hacking allegations, it can be revealed.
Thalha Jubair, 19, from Tower Hamlets, is accused of conspiring to commit computer fraud, and other offences including money laundering, on a massive scale in cases where targeted firms paid more than US $115m in ransom.
Jubair appeared at Westminster magistrates’ court on Thursday after being charged with hacking into TfL’s systems on or around August 31 last year.
An alleged co-conspirator, Owen Flowers, 18, from Walsall, West Midlands, has also been charged.
The National Crime Agency believes that members of an online criminal collective known as Scattered Spider were involved in targeting TfL.
According to information published by the US Department of Justice on Thursday evening, Jubair also faces charges relating to “conspiracies to commit computer fraud, wire fraud, and money laundering, in relation to at least 120 computer network intrusions and extortion involving 47 U.S. entities”.
If convicted, he faces a maximum penalty of 95 years in prison, according to the US Department of Justice.
The allegations, which also relate to Scattered Spider, have been filed by US prosecutors in New Jersey, where some of the targeted firms are based.
The US cyber attacks were said to have caused widespread disruption to US businesses and organisations, including critical infrastructure and the federal court system.
The FBI was also involved in the investigation, and worked alongside the National Crime Agency and the City of London Police.
It is alleged that Jubair used the pseudonyms “EarthtoStar”, “Brad”, “Austin,” and “@autistic” and was involved in demanding ransom payments, some of which were paid in “cryptocurrency”.
He and his associates are alleged to have made about 120 “network intrusions” on at least 47 US firms between May 2022 and this month.
“Scattered Spider” has also been known as “Octo Tempest,” “UNC3944,” and/or “0ktapus.”
Jubair is charged with computer fraud conspiracy, two counts of computer fraud, wire fraud conspiracy, two counts of wire fraud, and money laundering conspiracy.
Teenagers charged with TfL cyber attack costing London millions of pounds
Revealed: Huge financial cost of TfL cyber attack
TfL cyber attack: Contactless journey history and refund applications restored
TfL reopens applications for Zip Oyster cards for children and teenagers
Applications for Student Oyster cards reopen as TfL starts to lift cyber attack restrictions
