Two males pleaded responsible in the UK this week to legal expenses stemming from an August 2024 cyberattack that crippled Transport for London, the entity accountable for the general public transport community within the Larger London space. The duo have been key members of a prolific cybercrime group generally known as Scattered Spider, and their responsible pleas got here on the primary day of what was anticipated to be a six-week trial.
Owen Flowers (left) 18, and Thalha Jubair, 20. Picture: UK Nationwide Crime Company (NCA).
Thalha Jubair, 20, of East London and 18-year-old Owen Flowers of Walsall admitted conspiring to commit unauthorized acts towards Transport for London pc methods and inflicting danger of significant harm to human welfare. In response to a report from the BBC, Flowers alone admitted to being a part of a conspiracy to hack into U.S. primarily based healthcare suppliers SSM Well being Care Company and Sutter Well being in September 2024.
Jubair can also be needed by U.S. legislation enforcement businesses. In September 2025, prosecutors in New Jersey unsealed an indictment alleging Jubair and different Scattered Spider members dedicated pc fraud, wire fraud, and cash laundering in relation to 120 pc community intrusions involving 47 U.S. entities between Might 2022 and September 2025, and that the group’s victims paid no less than $115 million in ransom funds.
In July 2025, KrebsOnSecurity reported that Flowers and Jubair have been arrested in the UK in reference to Scattered Spider ransom assaults towards the retailers Marks & Spencer and Harrods, and the British meals retailer Co-op Group. A number of sources aware of these investigations mentioned Flowers was the Scattered Spider member who anonymously gave interviews to the media within the days after the group’s September 2023 ransomware assaults disrupted operations at Las Vegas casinos operated by MGM Resorts and Caesars Leisure.
In response to prosecutors, Jubair co-ran a bustling Telegram channel known as Star Chat, the house of a SIM-swapping group that used voice- and SMS-based phishing assaults to steal credentials from staff on the main wi-fi suppliers within the U.S. and U.Ok. The group would then use that entry to promote a service that would redirect a goal’s telephone quantity to a tool the attackers managed and intercept the sufferer’s calls and textual content messages (together with one-time codes for multi-factor authentication).
A receipt from Star Fraud Chat’s SIM-swapping service focusing on a T-Cellular buyer after the group gained entry to inside T-Cellular worker instruments. “Rocket Ace” was one in all Jubair’s hacker handles, in keeping with U.S. prosecutors.
New Jersey prosecutors additionally allege Jubair additionally was concerned in a mass SMS phishing marketing campaign in the course of the summer time of 2022 that stole single sign-on credentials from staff at a whole bunch of corporations. That weeks-long SMS phishing marketing campaign led to intrusions and knowledge thefts at greater than 130 organizations, together with LastPass, DoorDash, Mailchimp, Plex and Sign.
KrebsOnSecurity reported final 12 months that one in all Jubair’s alter egos at age 15 was “Everlynn,” a hacker who bought fraudulent “emergency knowledge requests” that used compromised police and authorities electronic mail addresses to demand subscriber knowledge (e.g. username, IP/electronic mail deal with) from main tech corporations, claiming the requests involved pressing issues of life and demise and couldn’t watch for a courtroom order.
In April 2026, 24-year-old British nationwide and Scattered Spider member Tyler “Tylerb” Buchanan pleaded responsible to wire fraud conspiracy and aggravated identification theft for taking part within the group’s SMS phishing spree in the summertime of 2022. The federal government mentioned Buchanan, Jubair and others used the credentials harvested in that phishing marketing campaign to steal no less than $8 million in cryptocurrency from victims all through the US. Buchanan is at present scheduled to be sentenced on October 2.
In August 2025, 20-year-old Scattered Spider member from Florida named Noah Michael City was sentenced to 10 years in federal jail and ordered to pay $13 million in restitution, after pleading responsible to expenses of wire fraud and conspiracy.
The U.S. Division of Justice says three alleged Scattered Spider defendants indicted together with Buchanan nonetheless face expenses, together with Ahmed Hossam Eldin Elbadawy, 24, a.ok.a. “AD,” of Faculty Station, Texas; Evans Onyeaka Osiebo, 21, of Dallas, Texas; and Joel Martin Evans, 26, a.ok.a. “joeleoli,” of Jacksonville, North Carolina.
Flowers and Jubair are slated to be sentenced in a London courtroom on July 15, 2026.
