Two teenagers accused of hacking into Transport for London‘s systems and attempting to install ransomware conducted a cyber attack that cost £39million, a court heard today.
Thalha Jubair, 19, and Owen Flowers, 18, both deny carrying out the attack, which prosecutors called ‘highly sophisticated’.
Between August 31 and September 3 last year, the teenagers allegedly hacked into the TfL system and caused chaos for Oyster card users.
The hackers prevented live Tube arrival information on TfL Go and the TfL website, while online journey history was also unavailable.
The result was that TfL was unable to process any payments on the Oyster and contactless apps or register Oyster cards to customer accounts, Westminster Magistrates’ Court heard.
Prosecutor Alistair Richardson earlier said: ‘The attack was a highly sophisticated attack against Transport for London.
‘The ultimate objective of the attack was to install ransomware.’
The attack was carried out by members of the online criminal collective known as ‘Scattered Spider.’
Two teenagers (not pictured) are accused of hacking into TfL’s systems and attempting to install ransomware on them
TfL was unable to process any payments on the Oyster and contactless apps or to register Oyster cards to customer accounts
Bespectacled Jubair appeared in the dock wearing a grey suit with a striped tie, while Flowers was wearing a black t-shirt with a grey hoodie tied around his shoulders.
Jubair, from Bow, East London, denied conspiring to carry out an unauthorised act against computer systems belonging to Transport for London, causing risk of serious damage to human welfare, and with failing to comply with a notice to disclose pins or passwords to devices seized by the police.
Flowers, from Walsall, West Midlands, denied one count of conspiring to commit an authorised act against computer systems belonging to Transport for London, and one count of conspiring to commit unauthorised acts against computer systems belonging to SSM Health Care Corporation, causing a risk of serious damage to human welfare.
Flowers further denied one count of attempting to commit unauthorised acts against computer systems belonging to Sutter Health.
Their trial will take place on 8 June next year. There will be a further hearing on February 13 which the pair will both be required to attend by video link.
Judge Christopher Hehir told the two teenagers: ‘Your trial, as you have been told, will take place in this court on 8 June. You will remain in custody in the meantime’, the judge told them.
Mr Richardson, prosecuting, said TfL suffered a £39million total loss as a result of the attack.
Deputy Director Paul Foster, head of the National Crime Agency’s National Cyber Crime Unit, earlier said: ‘This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure.
‘Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example.
‘The NCA, UK policing and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice.’