Two teenagers have been charged as part of a National Crime Agency (NCA) investigation into a cyber attack on Transport for London.

TfL suffered a major hack on 31 August last year, which investigators believe was carried out by members of the cyber-criminal group, Scattered Spider.

Thalha Jubair, 19, from east London, and Owen Flowers, 18, from Walsall in the West Midlands, were arrested at their home addresses on Tuesday by the NCA and City of London Police.

Both appeared at Westminster Magistrates Court on Thursday afternoon charged with conspiring together to commit unauthorised acts against TfL, under the Computer Misuse Act.

Deputy Director Paul Foster, head of the NCA’s National Cyber Crime Unit, said: “Today’s charges are a key step in what has been a lengthy and complex investigation.

“This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure.”

The court heard that the TfL hack occurred while Mr Flowers was on bail after being arrested in connection with multiple ransomware attacks, including those on Riot Games and MGM in 2023.

After he was arrested, detectives found evidence he had also targeted US healthcare companies.

So Mr Flowers has also been charged with conspiring, with others, to infiltrate and damage the networks of SSM Health Care Corporation and attempting to do the same to Sutter Health.

The prosecution alleges the risk of death to patients as a result of the disruption was known to the teenager, and he bragged about it online.

It also says the 18-year-old – who lives with his grandmother – had moved $200m worth of cryptocurrency through digital wallets that he owns.

When Mr Flowers appeared in court, he wore a grey hoodie with “off the grid” written on it. Mr Jubair sat next to him, wearing a black hoodie and black glasses.

Neither man spoke to each other during the proceedings.

The hack disrupted TfL services for three months.

TfL wrote to around 5,000 customers to say there may have been unauthorised access to their personal information such as bank account numbers and sort codes.

Data including names, emails and home addresses had been accessed, TfL added.

In a statement on Thursday afternoon it said: “We welcome this announcement by the National Crime Agency that two people have now been charged in relation to the cyber incident which impacted our operations last year.”

Earlier this year, the NCA warned of an increasing threat from cyber criminal gangs based in the UK and other English-speaking countries, of which Scattered Spider is an example.