The UK’s transport network has once again been reminded of the devastating risks posed by cyber crime. The National Crime Agency (NCA) has charged two teenagers in connection with the cyber attack on Transport for London (TfL) that caused £39 million in damages and months of disruption to critical systems.

What Happened in the TfL Hack?

The attack, which began on 31 August 2024, has been linked to the notorious cyber-criminal group Scattered Spider.

Two suspects — Thalha Jubair, 19, from East London, and Owen Flowers, 18, from Walsall — were arrested at their homes this week by the NCA and City of London Police.

Both appeared at Westminster Magistrates Court and were charged under the Computer Misuse Act for conspiring to carry out unauthorised acts against TfL. They have since been remanded in custody and will face further hearings at Southwark Crown Court.

The Cost of the Attack

Although TfL’s transport services — including the Tube, trains, and buses — were not directly affected, the cyber attack crippled online services, digital signage, and connected systems for more than three months.

Key impacts included:

• 5,000 TfL customers warned their data, including bank details, addresses, and emails, may have been accessed.

• 25,000 staff were required to verify their identities in person across London as part of the recovery.

• A total of £39 million in damages and disruption, according to TfL.

Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said:

“This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure.”

Wider Threats: UK and US Targets

Investigators revealed that one of the suspects, Owen Flowers, was already on bail at the time of the TfL hack. Police uncovered further evidence linking him to attempted cyber attacks on two major US healthcare providers — SSM Health Care Corporation and Sutter Health.

This highlights the growing international reach of cyber criminal gangs and their ability to target critical services across borders.

Earlier this year, the NCA warned that groups such as Scattered Spider — often based in the UK and other English-speaking countries — represent an escalating cyber threat to both public and private sector organisations.

What This Means for UK Businesses

The TfL attack is another stark reminder that no organisation is immune to cyber crime. Even well-resourced organisations within the UK’s critical national infrastructure can be severely disrupted.

Key lessons for businesses include:

• Data Protection: Sensitive customer data must be encrypted, monitored, and proactively defended against breaches.

• Business Continuity: Organisations need robust disaster recovery and backup systems to minimise downtime during an attack.

• Cyber Awareness: Staff training and strong access controls are vital to reduce insider threats and human error.

• Managed IT Security: Partnering with a trusted IT and cybersecurity provider ensures 24/7 monitoring, proactive defence, and compliance with regulations.

CSLN Group’s Perspective

At CSLN Group, we help organisations of all sizes — from education providers to SMEs and public services — build resilience against threats like ransomware, phishing, and large-scale hacks.

With our managed IT services, cloud security solutions, and proactive monitoring, we ensure your business is protected, compliant, and ready to recover quickly in the event of an attack.

Secure Your Organisation Before It’s Too Late

The TfL cyber attack shows how devastating the costs of weak security can be — financially, operationally, and reputationally.

📞 Contact CSLN Group today for a free consultation and discover how our cybersecurity and IT support services can protect your organisation from the next big threat.