Two British young men have pleaded guilty to a 2024 cyberattack on Transport for London (TfL), the authority that runs the city's transport network. Thalha Jubair, 20, from East London, and Owen Flowers, 18, from Walsall in the West Midlands, entered guilty pleas at Woolwich Crown Court on June 22, 2026, on the first day of what was expected to be a six-week trial. Both were teenagers when they carried out the attack between August 31 and September 3, 2024. They are scheduled to be sentenced on July 16, 2026.

The attack caused an estimated £29 million ($38 million) in losses and recovery costs, though some sources report the figure as £39 million. The incident disrupted TfL's customer refund system, with data from the Oyster refunds system accessed and some customers experiencing significant delays in receiving money back. The application system for Oyster photocards used by children and young people was shut down. Live tube arrival information stopped appearing on the TfL Go app and website, the Oyster and contactless payment apps stopped working, and customers could not register Oyster cards to their accounts. TfL wrote to thousands of customers about unauthorized access to some personal information. Customer data was confirmed stolen on September 12, 2024. Following the breach, TfL required all 28,000 employees to report to an office in person to reset their passwords. The attack affected around 10 million customers, according to some reports.

The National Crime Agency (NCA) identified both men as members of the Scattered Spider hacking group, a loose collective of English-speaking hackers linked to major extortion incidents at several large companies, including attacks on Jaguar Land Rover and retailers including Marks and Spencer. Flowers was first arrested on September 6, 2024, and both were arrested again at their home addresses on September 16, 2024, or September 18, 2025, according to different reports. Officers seized multiple devices from Flowers' home, including laptops, desktop computers, hard drives, and USB storage devices. One laptop contained a screenshot showing network connectivity to TfL infrastructure, videos recorded by Flowers showing Jubair accessing TfL systems during the attack, and evidence of access to an online marketplace selling stolen login credentials. The pair communicated through Telegram and an online collaboration platform. Flowers later violated his bail conditions on two occasions in 2025.

Investigators found evidence linking Flowers to separate intrusions targeting U.S. healthcare providers SSM Health Care Corporation and Sutter Health around September 6, 2024. Flowers additionally pleaded guilty to attempting to hack computer systems belonging to these two American healthcare organizations. He denied two further hacking charges, which were ordered to lie on file.

Jubair faces additional charges unsealed in September 2025, alleging he participated in at least 120 computer network intrusions and extortion involving 47 U.S. entities, with victims paying $115 million or more in ransom payments to him and his associates. The U.S. Department of Justice linked him to cyberattacks on 47 American organizations that generated more than $100 million (£75 million) in ransom payments. He has been convicted of 22 offences in total, including 13 counts of fraud, unauthorized computer access, and blackmail. At the time of the TfL offences, he was already subject to a youth rehabilitation order for previous hacking crimes targeting BT, EE, and the chip company Nvidia, for which he was convicted at age 17. He also held a Bangladeshi passport that he had not declared to police, found hidden behind a sofa at his home. A previous hearing was told that $10 million was moved from Jubair's crypto wallets after his release from custody in March of last year, and $200 million worth of cryptocurrency had passed through accounts linked to him. Flowers held $7.1 million, including crypto, in accounts he controlled despite having no declared source of income. Both defendants have been diagnosed with autism, and Jubair also has depression and a severe mood disorder.

Deputy Director Paul Foster, head of the NCA's National Cyber Crime Unit, described the investigation as lengthy, highly complex, and painstaking. He stated that the attack caused millions of pounds in losses to a key part of the United Kingdom's critical national infrastructure and was a significant inconvenience for customers. He credited TfL's early engagement with law enforcement for the successful outcome and urged other organizations to do the same in similar circumstances. He also noted the growing threat from hackers based in the UK and other English-speaking countries, observing that major attacks on high-profile organizations have typically been carried out by Russian-speaking hackers or those based in the former Soviet Union. Deputy Commissioner Nik Adams of the City of London Police stated that those who target critical organizations, cause substantial financial harm, and disrupt the daily lives of the public will face consequences. London's Transport Commissioner Andy Lord welcomed the guilty pleas and emphasized that the security of systems and customer data remains extremely important. Mr Justice Turner remanded both defendants in custody.

Original Sources: 1, 2, 3, 4, 5, 6, 7, 8

This article has limited practical value for a normal person. It reports a specific criminal case involving a cyberattack on Transport for London, but it does not give the reader anything concrete to do, try, or apply to daily life. There are no steps, choices, instructions, or tools offered. The only actions mentioned are that two people were arrested, entered guilty pleas, and are awaiting sentencing, which applies only to the people directly involved. For a general reader, there is no action to take from this article alone.

In terms of educational depth, the article stays mostly on the surface. It mentions the Computer Misuse Act, the Oyster refunds system, and the concept of critical national infrastructure, but it does not explain what those things mean in practical terms, how cyberattacks on public systems actually work, or what factors determine whether a young person faces serious consequences for online crimes. The number 29 million pounds is given, but the article does not explain how that figure was calculated or what it includes. The number 5 million daily journeys is mentioned, but the article does not explain why that number matters for understanding the scale of disruption. The information is factual but shallow, so it does not teach enough to help a reader truly understand the situation.

Personal relevance is also limited. The event affects a specific transport network, specific individuals, and a specific legal case. For most readers outside London, this does not touch their safety, money, health, or decisions in a direct way. Even for London readers, the article does not explain whether the systems are now safer, whether refund delays have been resolved, or what has changed since the attack. The only broader connection is that it involves cybercrime and public services, but the article does not draw those lessons out in a way that applies to everyday life.

The article does have a small public service value in that it mentions the attack, the charges, and the upcoming sentencing date. That is basic legal reporting, but it was only relevant for a short time and a small area. Beyond that, the article does not offer warnings, safety education, or help for the public. It mainly recounts an event rather than serving the reader.

There is no practical advice to evaluate. No steps or tips are given that an ordinary person could follow. The article does not teach readers how to protect themselves from cybercrime, how to recognize suspicious online behavior, what to do if they witness a cyberattack, or how to understand the legal risks of hacking. It does not even explain basic digital safety practices that a reader could apply.

The long term impact is weak. The article focuses on a short lived event with no lasting guidance. It does not help a reader plan ahead, stay safer online, improve their digital habits, or make stronger choices for the future. Once the sentencing date passes, the article will have no remaining value for a reader.

Emotionally, the article is fairly neutral. It describes a cyberattack and criminal charges, but it does not use dramatic or sensational language. It may create some concern or curiosity, but not fear or shock. That is a strength, but it does not add practical help.

The language is not clickbait style. The article does not use exaggerated claims or repeated dramatic phrases. It is straightforward reporting, which is better than sensationalism, but that alone does not make it useful.

The article misses several chances to teach or guide. It presents a problem, a cyberattack on critical infrastructure by young people, but does not explain what readers should know about digital safety, why young people sometimes take serious online risks, how public organizations protect systems, or how people can protect themselves and their families from similar threats. A reader could learn more by comparing news reports from different outlets, thinking about general online safety practices, or considering how personal decisions about technology use can have serious legal consequences. The article itself does not provide that guidance.

To add real value, a reader can take away a few general lessons. If you use public digital services, be aware that large systems can be targets for attacks, and delays or disruptions may happen without warning, so it helps to keep records of transactions and have a backup plan for essential travel or payments. If you are a young person or know young people, remember that online actions, even those that seem like experimentation or curiosity, can lead to serious criminal charges with long lasting consequences, so it helps to think carefully before accessing systems you are not authorized to use. If you ever notice suspicious activity on a public service system, report it through official channels rather than trying to investigate it yourself. When thinking about personal safety online, remember that digital actions leave records and traces, so it helps to treat every online interaction as something that could be examined later. For general planning, this story is a reminder that a single decision made in a short moment can lead to serious legal, financial, and personal consequences, which makes it worth building a habit of pausing and considering the risks before acting, especially when technology makes it easy to do things that feel low risk but are not. These are simple, realistic ways to apply the situation without needing special knowledge or outside data.

The text says "Deputy Director Paul Foster, who leads the National Crime Agency's National Cyber Crime Unit, described the investigation as lengthy, highly complex, and painstaking." These words are strong describing words that make the police work sound very hard and careful. This helps the National Crime Agency by showing them as thorough and dedicated. It hides any chance that the investigation had mistakes or delays that were their fault. The reader is guided to trust the agency and see them as heroes in this story.

The text says "He noted that the attack on Transport for London's systems showed real-world consequences and a huge public impact, causing millions of pounds in losses to a key part of the United Kingdom's critical national infrastructure and significant inconvenience for customers." The phrase "critical national infrastructure" is a strong phrase that makes the attack sound like it threatened the whole country, not just one city's transport. This helps the government and police by making the crime seem bigger and more serious than it might otherwise appear. It pushes the reader to feel that the hackers attacked something that belongs to everyone, which builds anger toward the accused. The word "inconvenience" is a soft word that downplays how bad the disruption really was for people waiting for their money back.

The text says "Deputy Commissioner Nik Adams of the City of London Police stated that those who target critical organisations, cause substantial financial harm, and disrupt the daily lives of the public will face consequences." This sentence uses strong words like "substantial financial harm" and "disrupt the daily lives of the public" to make the crime feel very serious. It helps the police by showing them as protectors of ordinary people. The phrase "will face consequences" is a warning that makes the reader feel the justice system is strong. It hides any details about what those consequences might actually be or whether they fit the crime.

The text says "Transport for London is the public body responsible for much of the city's transport network, handling up to 5 million passenger journeys each day on the London Underground alone." This detail is picked to show how important Transport for London is to everyday life. It helps the prosecution by making the reader feel that the attack hurt millions of people. The number "5 million" is chosen to impress and to make the crime seem like it had a very wide effect. It hides any facts about how quickly the system recovered or how many people were actually affected in a serious way.

The text says "Data from the Oyster refunds system was accessed, and the customer refund system was disrupted, leaving some people waiting far longer than usual for their money back." This sentence uses passive voice in "was accessed" and "was disrupted" to hide who did the accessing and disrupting, even though the text already says Jubair and Flowers are guilty. The passive voice here makes the event sound like something that just happened on its own. The phrase "some people" is a soft phrase that hides how many people were actually affected. It makes the harm sound smaller than it might have been.

The text says "Following the breach, Transport for London required all 28,000 employees to report to an office in person to reset their passwords." This detail is picked to show Transport for London taking strong action after the attack. It helps Transport for London by making them look responsible and quick to respond. It hides any criticism of how the breach happened in the first place or whether their security was weak. The reader is guided to see Transport for London as a victim that handled things well, not as an organization that might have been at fault for poor security.

The text says "Flowers had first been arrested on September 6, 2024, as part of the same investigation." This fact is placed in the text to show that Flowers was known to police early on. It helps the prosecution by making it seem like the case against him was strong from the start. It hides what happened between his first arrest and his guilty plea, including whether he was free during that time and what he did. The reader may think the police had him in sight the whole time, which makes the justice system look efficient.

The text says "Officers seized several devices from his home, including laptops, desktop computers, hard drives, and USB storage devices." This list of devices is picked to make the evidence sound large and solid. It helps the prosecution by showing that the police found a lot of proof. It hides whether all of those devices were actually used in the crime or whether some were just personal items. The reader is guided to think the evidence was overwhelming, which supports the guilty plea.

The text says "One laptop contained a screenshot showing a connection to Transport for London infrastructure, while another held videos recorded by Flowers that showed Jubair accessing Transport for London systems during the attack." These details are very specific and are picked to make the evidence sound undeniable. They help the prosecution by painting a clear picture of guilt. The fact that Flowers recorded videos of Jubair accessing the system makes both of them look very guilty. It hides any explanation the defendants might have had for why those files were on the devices.

The text says "The evidence revealed the pair communicated through Telegram and an online collaboration platform to share access and information." This sentence uses the word "revealed" to make it sound like the evidence told the truth on its own. It helps the prosecution by making the case seem open and shut. It hides any chance that the messages could have been taken out of context or misunderstood. The reader is guided to believe the pair clearly worked together with bad intent.

The text says "Flowers later violated his bail conditions on two occasions in 2025." This fact is placed in the text to make Flowers look like someone who does not follow rules. It helps the prosecution by making him seem like a continued risk. It hides what the bail conditions were or why he violated them, which might have been for small or understandable reasons. The reader is guided to see him as a person who keeps getting in trouble, which makes the guilty plea seem expected.

The text says "Investigators found evidence linking Flowers to separate intrusions targeting U.S. healthcare providers SSM Health and Sutter Health." This detail is added to make Flowers look like a repeat offender who attacks important systems. It helps the prosecution by showing a pattern of bad behavior. It hides whether those other intrusions were proven in court or were just claims by investigators. The reader is guided to see Flowers as a serious criminal, not just someone who did one bad thing.

The text says "Two members of the hacker group Scattered Spider have admitted guilt over a 2024 cyberattack on Transport for London." This opening sentence uses the phrase "admitted guilt" to make it clear that the accused are guilty and have said so themselves. It helps the prosecution by starting the story with a fact that cannot be argued with. It hides any details about why they admitted guilt, such as whether they were offered a deal or felt they had no choice. The reader is guided to accept their guilt as the starting point and not question it further.

The text says "The attack caused 29 million pounds in losses and recovery costs." This number is placed early in the text to make the crime sound very expensive and serious. It helps Transport for London and the prosecution by showing a large financial harm. It hides how that number was calculated or whether it includes costs that might have happened anyway. The reader is guided to feel that the crime was very costly, which builds support for harsh punishment.

The text says "Thalha Jubair, age 20, from London, and Owen Flowers, age 18, from Walsall, entered guilty pleas in a London court under the UK's Computer Misuse Act." This sentence gives the ages of both defendants, which makes them sound young. This could help the reader feel some sympathy for them because they are young. It also names their home areas, which grounds them as real people from real places. The text does not hide their guilt, but the mention of their ages might soften how the reader feels about them slightly.

The text says "Sentencing is set for July 16." This short sentence at the end tells the reader that the story is not over yet. It helps the justice system by showing that the process is moving forward in an orderly way. It hides what the possible sentences might be or what factors the judge will consider. The reader is guided to wait for the next part of the story without questioning whether the sentencing will be fair.

The text says "leaving some people waiting far longer than usual for their money back." The phrase "far longer than usual" is a soft way of describing the delay without saying exactly how long people waited. It hides the real length of the delay, which might have been days, weeks, or months. This helps Transport for London by not making the delay sound as bad as it might have been. The reader is guided to feel that the delay was noticeable but not extreme.

The text says "The application system for Oyster photocards used by children and young people was also shut down." This detail is picked to make the attack sound like it hurt vulnerable groups, specifically children and young people. It helps the prosecution by making the crime seem worse because it affected kids. It hides how long the system was down or how many children were actually affected. The reader is guided to feel extra anger toward the hackers because children were involved.

The text says "Following the breach, Transport for London required all 28,000 employees to report to an office in person to reset their passwords." The phrase "required all 28,000 employees to report to an office in person" makes the response sound big and serious. It helps Transport for London by showing they took strong action. It hides whether this was a smart move or whether it caused big problems for workers who had to travel. The reader is guided to see Transport for London as responsible, not as an organization that might have been unprepared.

The text says "The two were arrested at their home addresses on September 16, 2025, by officers from the National Crime Agency and the City of London Police." This sentence uses passive voice in "were arrested" to focus on the event rather than on the officers who did the arresting. It hides the specific actions of the police during the arrest. It helps the police by making the arrest sound clean and official. The reader is guided to see the arrest as a normal part of the process, not something that might have been rough or unfair.

The text says "Deputy Director Paul Foster, who leads the National Crime Agency's National Cyber Crime Unit, described the investigation as lengthy, highly complex, and painstaking." The use of a direct quote from a high-ranking official adds authority to the text. It helps the National Crime Agency by letting one of their own speak for them, which can sound more trustworthy than if the writer just said the same thing. It hides any other views of the investigation, such as whether some people thought it was slow or poorly managed. The reader is guided to trust the official's words because of his title and position.

The text expresses several meaningful emotions that work together to shape how the reader feels about the story. The most prominent emotion is a sense of seriousness and gravity, which appears throughout the piece. Words like "lengthy," "highly complex," and "painstaking" describe the investigation in a way that makes the reader feel this was a very big and difficult case. These words are strong and make the police sound like they worked very hard. The purpose of this emotion is to build trust in the police and make the reader feel that the people in charge are taking the situation very seriously. It guides the reader to respect the work that was done and to believe that the case was handled well.

Another emotion present in the text is concern or worry about harm done to ordinary people. The phrase "significant inconvenience for customers" carries emotional weight because it reminds the reader that real people were affected. The word "inconvenience" is a softer word, but it still creates a feeling that something went wrong for everyday people who were just trying to get their money back. The mention of "children and young people" whose Oyster photocard application system was shut down adds another layer of concern, because most people feel protective of children. This emotion serves to make the reader feel that the attack was not just about computers or money, but about real people who depend on public services. It guides the reader to feel that the crime was worse because it affected vulnerable groups.

The text also expresses a sense of authority and strength from the police and government officials. When Deputy Commissioner Nik Adams says that those who cause harm "will face consequences," the emotion behind those words is firmness and warning. This is meant to make the reader feel that the justice system is strong and that bad actions will not be ignored. The phrase "will face consequences" does not say exactly what will happen, but it creates a feeling that something serious is coming. This emotion serves to reassure the reader that the system works and to discourage anyone from thinking about doing something similar. It guides the reader to trust that the police are in control.

There is also a hidden emotion of disapproval or judgment toward the two people who admitted guilt. The text mentions that Flowers violated his bail conditions twice, which makes him look like someone who does not follow rules. This detail creates a feeling that he is not trustworthy and keeps getting into trouble. The text also mentions that investigators found evidence linking him to other attacks on hospitals in the United States, which adds to the feeling that he is a repeat offender. This emotion serves to make the reader feel that these two people deserve what is coming to them. It guides the reader to see them as people who made bad choices over and over, not as people who made one mistake.

The emotion of pride appears quietly in the way the police describe their own work. When Deputy Director Paul Foster calls the investigation "lengthy, highly complex, and painstaking," he is not just describing the work, he is also showing pride in what his team accomplished. These words make the police sound dedicated and skilled. The purpose of this emotion is to make the reader feel that the National Crime Agency is good at its job and that they care about getting things right. It guides the reader to see the police as heroes who protected the public.

The writer uses emotion to persuade by choosing words that sound stronger or softer than neutral language would. For example, the phrase "critical national infrastructure" is much stronger than saying "important transport system." It makes the attack sound like it threatened the whole country, not just one city. This word choice pushes the reader to feel that the crime was very serious. The writer also uses the number "29 million pounds" early in the text to create a feeling of shock about how much money was lost. Big numbers like this make the reader feel that the crime was huge. The writer repeats the idea that the attack affected many people by mentioning "5 million passenger journeys each day" and "28,000 employees" who had to reset their passwords. These numbers are not just facts, they are tools to make the reader feel the scale of what happened.

The writer also uses the tool of quoting authority figures directly. When Paul Foster and Nik Adams speak in their own words, it feels more emotional and personal than if the writer just said the same things in a neutral way. Direct quotes make the reader feel like they are hearing from real people who care about the case. This increases the emotional impact because the reader is more likely to trust someone who is speaking directly than someone who is just being described. The writer also uses comparison by mentioning that Flowers was linked to attacks on hospitals in the United States. This comparison makes his actions seem worse because it shows a pattern, not just one event. It guides the reader to feel that he is a serious criminal, not just a young person who made a mistake.

Overall, the emotions in the text work together to make the reader feel that the crime was very serious, that the police did a good job, and that the two people who admitted guilt deserve to be punished. The writer uses strong words, big numbers, direct quotes, and comparisons to increase the emotional impact. These tools guide the reader to trust the police, feel concern for the people who were affected, and believe that justice will be done. The emotions are not random, they are carefully chosen to shape the reader's opinion and reaction to the story.