Scattered Spider Hackers Plead Guilty
Two men, Thalha Jubair, 20, and Owen Flowers, 18, pleaded guilty in a London court to criminal charges related to an August 2024 cyberattack that crippled Transport for London, the entity responsible for the public transport network in the Greater London area.
The duo were key members of the prolific cybercrime group known as Scattered Spider, and their guilty pleas came on the first day of what was expected to be a six-week trial. Jubair and Flowers admitted conspiring to commit unauthorized acts against Transport for London computer systems and causing risk of serious damage to human welfare.
Conspiracy and Hacking Charges
According to a report from the BBC, Flowers alone admitted to being part of a conspiracy to hack into US-based healthcare providers SSM Health Care Corporation and Sutter Health in September 2024. Jubair is also wanted by US law enforcement agencies.
In September 2025, prosecutors in New Jersey unsealed an indictment alleging Jubair and other Scattered Spider members committed computer fraud, wire fraud, and money laundering in relation to 120 computer network intrusions involving 47 US entities between May 2022 and September 2025, and that the group’s victims paid at least $115 million in ransom payments.
Scattered Spider's Activities
In July 2025, it was reported that Flowers and Jubair were arrested in the United Kingdom in connection with Scattered Spider ransom attacks against the retailers Marks & Spencer and Harrods, and the British food retailer Co-op Group.
Multiple sources familiar with those investigations said Flowers was the Scattered Spider member who anonymously gave interviews to the media in the days after the group’s September 2023 ransomware attacks disrupted operations at Las Vegas casinos operated by MGM Resorts and Caesars Entertainment.
Prosecutors also allege that Jubair co-ran a bustling Telegram channel called Star Chat, the home of a SIM-swapping group that used voice- and SMS-based phishing attacks to steal credentials from employees at major wireless providers in the US and UK.
Mass SMS Phishing Campaign
New Jersey prosecutors also allege that Jubair was involved in a mass SMS phishing campaign during the summer of 2022 that stole single sign-on credentials from employees at hundreds of companies. That weeks-long SMS phishing campaign led to intrusions and data thefts at more than 130 organizations, including LastPass, DoorDash, Mailchimp, Plex, and Signal.
KrebsOnSecurity reported last year that one of Jubair’s alter egos at age 15 was “Everlynn,” a hacker who sold fraudulent “emergency data requests” that used compromised police and government email addresses to demand subscriber data from major tech companies, claiming the requests concerned urgent matters of life and death and could not wait for a court order.
Other Scattered Spider Members
In April 2026, 24-year-old British national and Scattered Spider member Tyler “Tylerb” Buchanan pleaded guilty to wire fraud conspiracy and aggravated identity theft for participating in the group’s SMS phishing spree in the summer of 2022.
The government said Buchanan, Jubair, and others used the credentials harvested in that phishing campaign to steal at least $8 million in cryptocurrency from victims throughout the United States. Buchanan is currently scheduled to be sentenced on October 2.
In August 2025, 20-year-old Scattered Spider member from Florida named Noah Michael Urban was sentenced to 10 years in federal prison and ordered to pay $13 million in restitution, after pleading guilty to charges of wire fraud and conspiracy.
The US Department of Justice says three alleged Scattered Spider defendants indicted along with Buchanan still face charges, including Ahmed Hossam Eldin Elbadawy, 24, a.k.a. “AD,” of College Station, Texas; Evans Onyeaka Osiebo, 21, of Dallas, Texas; and Joel Martin Evans, 26, a.k.a. “joeleoli,” of Jacksonville, North Carolina.
Flowers and Jubair are slated to be sentenced in a London court on July 15, 2026.
Source: Krebs on Security