Two teenagers have been charged in connection with a massive cyber attack which caused Transport for London (TfL) months of disruption.
The National Crime Agency (NCA) says it believes the hack – which began on 31 August last year – was carried out by members of the cyber-criminal group, Scattered Spider.
Thalha Jubair, 19, from east London, and Owen Flowers, 18, from Walsall in the West Midlands, were arrested at their home addresses on Tuesday by the NCA and City of London Police.
Both appeared at Westminster Magistrates Court on Thursday afternoon charged with conspiring together to commit unauthorised acts against TfL, under the Computer Misuse Act.
They have been remanded in custody to appear at Southwark Crown Court at a later date.
TfL says the hack caused it £39m of damage and disruption.
The hack disrupted TfL services for three months.
Whilst trains, buses and other transport was unaffected, many TfL online services and connected information boards went offline as part of the attack.
TfL wrote to around 5,000 customers to say there may have been unauthorised access to their personal information such as bank account numbers and sort codes.
Data including names, emails and home addresses were accessed.
Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said: “Today’s charges are a key step in what has been a lengthy and complex investigation.
“This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure.”
The court heard that the TfL hack occurred while Mr Flowers was on bail.
After he was arrested, detectives found evidence he had also targeted US healthcare companies.
Mr Flowers has been charged with conspiring, with others, to infiltrate and damage the networks of SSM Health Care Corporation and attempting to do the same to Sutter Health.
When Mr Flowers appeared in court, he wore a grey hoodie with “off the grid” written on it. Mr Jubair sat next to him, wearing a black hoodie and black glasses.
Neither man spoke to each other during the proceedings.
TfL’s 25,000 staff were forced to report into offices around the capital to have their identities verified as part of the large and lengthy recovery operation.
In a statement on Thursday afternoon, it said: “We welcome this announcement by the National Crime Agency that two people have now been charged in relation to the cyber incident which impacted our operations last year.”
Earlier this year, the NCA warned of an increasing threat from cyber criminal gangs based in the UK and other English-speaking countries, such as Scattered Spider.
