LONDON — Thalha Jubair, 20, and Owen Flowers, 18, pleaded guilty to offences under the Computer Misuse Act at Woolwich Crown Court on Monday. The pair admitted conspiring to commit unauthorised acts against computer systems belonging to Transport for London.

The cyber-attack on Transport for London cost £39m and disrupted services for three months, beginning on 31 August 2024. During the attack, live tube arrival information was prevented from appearing on the TfL Go app and the TfL website. Transport for London was unable to process payments on Oyster and contactless apps or register Oyster cards to customer accounts. The application system for Oyster photocards for children and young people was also shut down.

Transport for London emailed more than 7 million customers in September 2024, informing them that some customer data may have been taken. The BBC reported that 10 million Transport for London customers had their data stolen in the cyber-attack.

The National Crime Agency stated it believed the attack was carried out by an online hacking community known as Scattered Spider. Paul Foster, head of the agency's national cyber crime unit, said, "The profile of offenders like Flowers and Jubair demonstrates the increasing threat from cyber criminals based in the UK and other English-speaking countries, epitomised by Scattered Spider." He added, "The damage showed cybercrime has real-world consequences and impacts hugely on the public."

Flowers, from Walsall, West Midlands, also admitted conspiring to commit unauthorised acts against computer systems belonging to SSM Health Care Corporation. Additionally, he admitted attempting to commit unauthorised acts against computer systems belonging to Sutter Health on or about 6 September 2024. Investigators found several devices at Flowers' home, including laptops, hard drives, and USB sticks. One laptop contained a screenshot showing network connectivity to Transport for London infrastructure, as well as videos Flowers recorded of Jubair accessing the systems during the attack.

Jubair, from Bow, east London, and Flowers used the Telegram messaging platform and an online tool for remote collaboration to communicate. The US Department of Justice has accused Jubair of involvement in a series of cyber-attacks that targeted 47 US organisations, reportedly garnering more than $100m in ransom payments. The pair entered their guilty pleas on the first day of what was due to be a six-week trial, stating they recklessly accessed the systems without intent. Mr Justice Turner remanded them in custody, saying, "I express gratitude for the hard work that has enabled the court to find a satisfactory way forward." A two-day sentencing hearing is scheduled for 15 July.

Flowers denied two further hacking charges, and Jubair denied failing to disclose information after officers seized his devices on 19 March of the previous year. These charges were ordered to lie on file.