Pair admit major TfL cyberattack that affected 28,000 employees

• Two men, Thalha Jubair, 20, and Owen Flowers, 18, pleaded guilty to a cyber attack on Transport for London (TfL) that caused an estimated £39 million in losses.
• The attack, which occurred between 29 August and 6 September 2024, led to a password reset for 28,000 employees and compromised the Oyster refund system.
• Jubair and Flowers, identified as members of the 'Scattered Spider' hacking collective, changed their pleas at Woolwich Crown Court just before their trial.
• Owen Flowers also admitted to targeting US healthcare firms, with evidence found at his home including screenshots of TfL access and videos of Jubair.
• The pair are due to be sentenced on 15 and 16 July, with the National Crime Agency highlighting the significant impact of such cyber crimes on critical national infrastructure.

IN FULL

Two members of criminal hacking group plead guilty to £39m TfL hack