Two teenagers have been arrested and charged by the National Crime Agency as part of its investigation into the cyber-attack against Transport for London back in August of last year.

The cyber-attack, which took place on 31 August 2024, was believed to be perpetrated by members of the cyber gang Scattered Spider, which is also behind the M&S attack and other retail hacks earlier this year.

Transport for London services were disrupted for three months as a result of the hack.

Now, 19-year-old Thalha Jubair from east London, and 18-year-old Owen Flowers of the West Midlands have been arrested and charged for conspiracy to commit unauthorised acts against the transport authority under the Computer Misuse Act.

“Today’s charges are a key step in what has been a lengthy and complex investigation,” Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit said.

“This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure.”

The data hacked included names, emails, and home addresses, as well as bank account numbers and sort codes.

Who Are Scattered Spider?

Scattered Spider infamy peaked following the M&S hack that held the UK retail titan to its knees for months with disruptions, as well as several other targeted attacks of UK retail vendors.

The ransomware groups is known for having young members who mainly speak native-English, often giving social engineering tactics a leg-up when it comes to duping unsuspecting victims.

Recommended reading

• M&S Hackers Take Credit for Jaguar Land Rover Cyber-attack
• Scattered Lapsus$ Hunters Say They Are Shutting Down
• How Scattered Spider’s Web Brought UK Retail to its Knees
• Four Arrested in Investigation Into UK Retail Cyber-attacks

While some arrests of alleged group members took place following the retail attacks, the size of the gang’s network remains unknown.

Scattered Lapsus$ Hunters, a spin-out group from Scattered Spider and two other cyber gangs, recently announced their retirement from cyber-crime, citing the Scattered Spider group as another group set to lay down their keyboards when it comes to ransomware. Whether the gang sticks to this shut down, however, remains to be seen.

Scattered Spider and the young alleged members also reflects a growing problem in the UK – the rise of young cyber-criminals as a creeping threat to the UK’s cybersecurity. The average age of a cyber-criminal in the UK is just 17 years old, with the ICO warning of the rising threats of students to educational institution’s cybersecurity.

Young people can be led to a life of cyber-crime through online forums, video games, and for financial gain.