Two teenagers have been charged in connection with a cyberattack against London’s public transportation network in August 2024. UK investigators believe the “network intrusion” that impacted Transport for London (TfL) last year was carried out by members of the Scattered Spider online criminal group and caused “significant disruption and millions in losses,” according to Paul Foster, head of the National Crime Agency’s cyber crime unit.

Thalha Jubair, 19, and Owen Flowers, 18, were arrested at their home addresses on Tuesday. Both teens were charged under the Computer Misuse Act with conspiracy to commit an unauthorized act against TfL. The Scattered Spider group, comprised of US and UK-based hackers, is also connected to attacks against MGM, Caesars Entertainment, and Marks & Spencer.

“Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example,” Foster said. “Today’s charges are a key step in what has been a lengthy and complex investigation.”