Two men plead guilty over TfL cyber attack that caused months of disruption

Two men have pleaded guilty in connection with a cyber attack on Transport for London that caused months of disruption and an estimated £39m in damage. The pleas were entered at Woolwich Crown Court on what had been expected to be the first day of a six-week trial. The case centres on an attack that TfL says began on 31 August 2024.

Sponsored

Thalha Jubair, 20, from east London, and Owen Flowers, 18, from Walsall in the West Midlands, changed their pleas to guilty. Both admitted conspiring to commit unauthorised acts against TfL under the Computer Misuse Act. The court heard that they pleaded guilty on the basis that they recklessly accessed the systems without intending to do so.

Flowers also pleaded guilty to attempting to hack computer systems belonging to Sutter Health, a California-based organisation, and SSM Healthcare Corporation. TfL has previously said the attack caused £39m of damage and disrupted services for three months. The scale of the impact underlines how a cyber incident can affect a major public transport network well beyond the initial breach.

TfL is one of the most important transport operators in London, and the case has drawn attention because of the length of the disruption and the financial cost involved. Cyber attacks on large public bodies can create operational problems, legal exposure and wider concerns about the security of connected systems. In this case, the guilty pleas remove the need for a full trial on the charges now admitted.

Sponsored

The incident also highlights the growing overlap between transport infrastructure and cyber security enforcement. The charges were brought under the Computer Misuse Act, which is used in cases involving unauthorised access to computer systems. The fact that the alleged activity extended beyond TfL to US healthcare organisations suggests investigators were dealing with a wider pattern of attempted intrusions.

What remains unclear from the court hearing is whether further charges or sentencing details will follow, and how the court will assess the full extent of responsibility. TfL has not yet given any new public estimate beyond the £39m figure it previously cited. The next stage will be the formal handling of the guilty pleas and any subsequent court decisions.

#TransportforLondon #cyberattack #guiltyplea #WoolwichCrownCourt #ComputerMisuseAct