The National Crime Agency (NCA) has announced that Thalha Jubair and Owen Flowers pleaded guilty to carrying out a cyber attack on Transport for London (TfL) in 2024, which compromised TfL's network, disrupted services and resulted in reported loss and recovery costs of £29 million. The pair, members of the online criminal group Scattered Spider, gained unauthorised access to TfL's systems, requiring the organisation to reset passwords for approximately 28,000 employees. The attack also disrupted Oyster refund services and applications for Oyster photocards, affecting customers. Investigators recovered digital evidence, including recordings, messages and screenshots, linking the defendants to the attack and demonstrating unauthorised access to TfL's systems. The investigation also identified evidence indicating that networks belonging to two US healthcare organisations had been compromised. Jubair and Flowers changed their pleas to guilty on the first day of their trial at Woolwich Crown Court on 22 June 2026 and are due to be sentenced on 16 July 2026.