2 English Teens Charged With Attacks

British law enforcement arrested two English teenagers in connection with a 2024 cyberattack against Transport for London that caused millions of pounds in damages. One suspect also faces U.S. charges tied to more than a hundred attacks against organizations globally that netted hackers $115 million in ransom payments.

See Also: Strengthening Your Security Program With Open API

Officers from Britain’s National Crime Agency together with City of London Police on Tuesday arrested Thalha Jubair, 19, in East London, and Owen Flowers, 18, in the West Midlands. Both are charged with violating Britain’s Computer Misuse Act. Jubair also faces an eight-count indictment in U.S. federal court.

U.S. prosecutors accused Jubair of participating in “a sweeping cyber extortion scheme” carried out by the band of adolescent hackers known as Scattered Spider. “These malicious attacks caused widespread disruption to U.S. businesses and organizations, including critical infrastructure and the federal court system,” said Acting Assistant Attorney General Matthew R. Galeotti of the Department of Justice’s Criminal Division.

The NCA accused the two men of breaching Transport for London’s network on Aug. 31, 2024, as well as being members of Scattered Spider, also tracked by security researchers as Octo Tempest, UNC3944 and 0ktapus. Experts said the group, largely comprised of Western teenagers who excel at social engineering, emerged from the cybercrime collective known as The Com that formed by 2022, and has claimed responsibility for a series of high-profile attacks that often mix data theft and extortion with ransomware (see: Scattered Spider Tied to Fresh Attacks on Financial Services).

Both men were scheduled to appear Thursday in Westminster Magistrates Court for an initial hearing, following the culmination of what police described as being “a lengthy and complex investigation” into the London transport hack attack.

Transport for London is the local government body that runs the day-to-day operations of the city’s public transport network and manages London’s main roads. The agency initially reported that attackers accessed no data but later acknowledged that hackers stole 5,000 travel cards, including associated bank account numbers and sort codes. The attack disrupted live subway arrival information and travel card services.

“This attack caused significant disruption and millions in losses to TfL, part of the U.K.’s critical national infrastructure,” said NCA Deputy Director Paul Foster, who heads its National Cyber Crime Unit. “Earlier this year, the NCA warned of an increase in the threat from cybercriminals based in the U.K. and other English-speaking countries, of which Scattered Spider is a clear example” (see: Rising Ransomware Issue: English-Speaking Western Affiliates).

Officers first arrested Flowers for the transit authority attack on Sept. 6, 2024, “at which point NCA officers identified further potential evidence of offending against U.S. healthcare companies,” the agency said, naming the targets as SSM Health Care and Sutter Health.

Jubair has also been charged under Britain’s Regulation of Investigatory Powers Act with “failing to disclose the PIN or passwords for devices seized from him,” the NCA said.

British authorities said the West Midlands Regional Organized Crime Unit and British Transport Police assisted with their investigation, as did the FBI and law enforcement agencies from the Netherlands, Australia, Canada and Romania.

The U.S. complaint against Jubair – aka “EarthtoStar,” “Brad,” “Austin” and “@autistic” – unsealed Thursday accuses him and his associates of first hacking into victims’ networks as early as May 2022, and said those attacks have continued through this month.

Authorities also accused the suspect of regularly laundering stolen proceeds. “Portions of the ransom payments from at least five victims were sent to wallets on a server controlled by Jubair,” prosecutors said. “In July 2024, while law enforcement was seizing that server – including successfully seizing cryptocurrency worth approximately $36 million at the time of the seizure – Jubair transferred a portion of cryptocurrency that originated from one of the victims, worth approximately $8.4 million at the time, to another wallet.”

If convicted of all of the U.S. charges filed against him, Jubair faces a maximum penalty of 95 years in prison.