Two young men who pleaded guilty this week to carrying out a major cyber-attack on Transport for London had been on the radar of law enforcement months and years before the incident, court records and investigators say. The breach, which began in late August 2024, caused prolonged disruption to services, exposed millions of passengers’ personal data and forced tens of thousands of staff to take emergency security measures.
Early contacts with police and intervention attempts
One of the defendants, then aged 16, first came to the attention of regional cyber crime prevention officers in October 2023 after being caught committing low-level online offences. He was visited by officers from a regional cyber unit and given a formal cease and desist notice, but was not enrolled on the national diversion scheme because he was already under investigation and did not engage with the intervention team.
The second defendant had a separate history of online offending and, with his co-defendant, became involved in a loose criminal collective linked to numerous intrusions against UK businesses. Investigators say repeated attempts were made to deter or divert both men from further illicit activity, but those interventions did not stop their involvement in more serious attacks the following year.
The TfL breach, arrests and material seized
The unauthorised intrusion on Transport for London’s systems began on 31 August 2024, according to court statements. The campaign of activity is understood to have disabled services and required wide-ranging remediation across IT systems. As a result, all 28,000 staff employed by the transport body were required to reset passwords in person, a measure intended to limit the risk of further compromise.
Police arrested one defendant on 16 September 2024. Search warrants executed at his home led to the seizure of multiple electronic devices including laptops, desktop machines and portable storage. Investigators also reported discovery of cryptocurrency holdings worth millions of pounds, which formed part of the financial evidence gathered during the inquiry.
Criminal grouping, wider impacts and the case in court
Prosecutors have described the pair as part of a loosely organised criminal collective that has been linked to a series of attacks on commercial organisations. The case has underscored how a small number of highly capable individuals can cause disproportionate damage to both private and public sector targets, according to investigators handling the matter.
Both defendants entered guilty pleas on the first day of trial this week. Their convictions follow a lengthy investigation that drew on specialist cyber crime teams and national law enforcement resources. Victim organisations continue to assess the full extent of data loss and operational disruption arising from the breach.
Law enforcement response and calls for stronger powers
Officials involved in the investigation say the case highlights challenges faced by police when dealing with technically skilled young offenders, including limits on early intervention powers. Senior officers have pointed to proposed measures that would allow courts to impose restrictions on people assessed as high risk of committing significant cyber offences, with the intention of permitting earlier interventions to prevent harm.
Those proposals form part of wider planned reforms to cybercrime legislation, which aim to give investigators additional tools to tackle organised online offending while balancing safeguards for legitimate security research and education programmes.
What this means for prevention and diversion schemes
The defendants’ earlier contact with prevention teams has prompted renewed scrutiny of how diversion programmes are applied when suspects are already the subject of criminal enquiries. One national programme, designed to steer young people away from cyber offending and towards constructive use of technical skills, is offered to those identified as suitable for rehabilitation. In this case, leaders of the prevention effort said the defendants were judged not to be appropriate for the scheme at the time because of active investigations and limited engagement.
Experts in youth offending and cyber security say the episode underlines the difficulty of balancing enforcement with rehabilitation, and the need for tailored approaches that recognise both the technical ability and the maturity of young people involved in digital crime.
Frequently asked questions
Who pleaded guilty?
Two young men, aged 18 and 20, entered guilty pleas to charges relating to the cyber-attack on Transport for London. Their names have been reported in court documents.
When did the breach occur and what was the immediate impact?
The unauthorised access began on 31 August 2024. The intrusion disrupted services for months, exposed personal data, and required all 28,000 staff to reset passwords in person as part of containment and recovery work.
Were these individuals known to police before the TfL attack?
Yes. One of the men was first identified by regional cyber prevention officers in October 2023 and received a cease and desist notice after being found to be involved in low-level cyber offending. Both had prior contacts with law enforcement before the 2024 attack.
Author: Senior Reporter, London Daily News
