Two Key Members of Notorious Scattered Spider Cybercrime Group Plead Guilty to Crippling Transport for London Attack and Other Global Cyber Offenses.

In a significant development for international cybercrime prosecution, two individuals identified as central figures within the notorious Scattered Spider cybercrime collective, Owen Flowers and Thalha Jubair, have pleaded guilty in the United Kingdom to a range of criminal charges. These charges stem notably from an August 2024 cyberattack that severely disrupted Transport for London (TfL), the public body responsible for managing the vast and complex transport network across the Greater London area. The guilty pleas, entered on the inaugural day of what was anticipated to be a six-week trial, underscore a concerted effort by global law enforcement to dismantle sophisticated cybercriminal organizations.

The Transport for London Attack: A Critical Infrastructure Breach

The August 2024 cyberattack against Transport for London sent shockwaves through the UK’s capital, impacting an essential service relied upon by millions daily. While the exact extent of the disruption and the full cost of remediation are still being assessed, initial reports indicated significant operational challenges, potential data compromise, and a substantial drain on resources to restore systems and ensure public safety. TfL, which oversees the London Underground, Overground, buses, and other transport modes, represents a critical national infrastructure target, making the breach particularly alarming.

Thalha Jubair, 20, from East London, and Owen Flowers, 18, from Walsall, admitted to conspiring to commit unauthorized acts against Transport for London’s computer systems. More critically, they also admitted to causing a risk of serious damage to human welfare, a charge that highlights the potentially catastrophic real-world consequences of cyberattacks on essential services. This charge reflects the understanding that disruptions to public transport can impede emergency services, delay critical personnel, and strand commuters, posing tangible risks to public safety and economic stability.

Scattered Spider: A Profile in Sophisticated Social Engineering

The duo’s affiliation with "Scattered Spider" — also known by various monikers such as UNC3944, Scatter Swine, and 0ktapus — places their actions within a broader context of highly effective and financially devastating cybercrime. This group has garnered a reputation for its adeptness at social engineering, often targeting employees of large corporations and technology firms to gain initial access to networks. Their primary weapon has frequently been SIM-swapping and sophisticated phishing campaigns, which allow them to bypass multi-factor authentication (MFA) and seize control of accounts.

SIM-swapping, a core tactic of Scattered Spider, involves tricking mobile carriers into porting a victim’s phone number to a SIM card controlled by the attacker. Once successful, the attackers can intercept calls and text messages, including crucial one-time passcodes used for MFA, thereby gaining unfettered access to a victim’s online accounts, from email and social media to banking and corporate networks. This method has proven devastatingly effective against numerous high-value targets.

A Global Trail of Victims and Financial Devastation

The charges against Jubair and Flowers extend far beyond the TfL incident, painting a picture of a prolific cybercrime enterprise with a global footprint. According to a report by the BBC, Owen Flowers alone admitted to participating in a conspiracy to hack into U.S.-based healthcare providers SSM Health Care Corporation and Sutter Health in September 2024. These attacks on healthcare systems are particularly insidious, potentially jeopardizing patient data, disrupting critical medical services, and incurring massive financial and reputational damage.

Thalha Jubair, in particular, is a wanted figure by U.S. law enforcement agencies. In September 2025, prosecutors in New Jersey unsealed a comprehensive indictment alleging Jubair’s involvement, alongside other Scattered Spider members, in an extensive campaign of computer fraud, wire fraud, and money laundering. This campaign reportedly involved approximately 120 computer network intrusions targeting 47 U.S. entities between May 2022 and September 2025. The indictment further claimed that victims collectively paid at least an staggering $115 million in ransom payments to the group, underscoring the immense financial scale of their operations.

High-profile corporate entities have fallen prey to Scattered Spider’s tactics. In July 2025, KrebsOnSecurity reported on the arrests of Flowers and Jubair in connection with ransomware attacks against major British retailers such as Marks & Spencer and Harrods, as well as the prominent British food retailer Co-op Group. These attacks, typically involving data exfiltration followed by encryption and ransom demands, caused significant operational disruptions, financial losses, and potentially exposed customer and employee data.

The Modus Operandi: From SIM-Swapping to Emergency Data Requests

The inner workings of Scattered Spider, as revealed by investigations, highlight a systematic approach to exploiting vulnerabilities. Prosecutors revealed that Jubair played a key role in co-running a Telegram channel named "Star Chat." This channel served as the operational hub for a SIM-swapping group that meticulously targeted employees at major wireless providers in both the U.S. and the U.K. using voice- and SMS-based phishing attacks. By compromising these employees, the group gained access to internal tools, enabling them to execute SIM swaps and hijack phone numbers, selling this illicit service to other criminals. A receipt from "Star Fraud Chat" targeting a T-Mobile customer, featuring one of Jubair’s hacker handles, "Rocket Ace," provides a stark illustration of these activities.

Beyond SIM-swapping, New Jersey prosecutors also implicated Jubair in a mass SMS phishing campaign during the summer of 2022. This widespread campaign aimed to steal single sign-on credentials from employees across hundreds of companies. This weeks-long phishing spree led to successful intrusions and data thefts at over 130 organizations, including technology and service providers such as LastPass, DoorDash, Mailchimp, Plex, and Signal. The compromise of such diverse and widely used services illustrates the cascading impact of initial access breaches, potentially affecting millions of end-users.

Another chilling aspect of Jubair’s alleged activities, under the alias "Everlynn" at the age of 15, involved the sale of fraudulent "emergency data requests" (EDRs). This sophisticated tactic exploited a legitimate mechanism used by law enforcement to obtain subscriber data (e.g., username, IP/email address) from tech companies in urgent matters of life and death, bypassing the need for a court order. By compromising police and government email addresses, "Everlynn" could forge these requests, illicitly obtaining sensitive user data from major tech firms, a clear abuse of a system designed for public safety.

International Cooperation Against a Transnational Threat

The successful arrests and guilty pleas of Flowers and Jubair underscore the critical importance of international collaboration in combating cybercrime. The cooperation between the UK’s National Crime Agency (NCA) and U.S. law enforcement agencies, including the Department of Justice (DoJ) and the FBI, has been pivotal in tracking, identifying, and prosecuting these young, yet highly effective, cybercriminals.

These convictions are not isolated incidents but part of a broader crackdown on Scattered Spider. In April 2026, 24-year-old British national and Scattered Spider member Tyler Buchanan, known online as "Tylerb," pleaded guilty to wire fraud conspiracy and aggravated identity theft. Buchanan was involved in the group’s extensive SMS phishing spree in the summer of 2022, which saw credentials harvested and subsequently used to steal at least $8 million in cryptocurrency from victims across the United States. His sentencing is scheduled for October 2.

Earlier, in August 2025, Noah Michael Urban, a 20-year-old Scattered Spider member from Florida, was sentenced to a substantial 10 years in federal prison and ordered to pay $13 million in restitution after pleading guilty to wire fraud and conspiracy charges. These cases highlight a pattern of severe penalties for those involved in such sophisticated cybercriminal enterprises.

The U.S. Department of Justice has also indicated that three other alleged Scattered Spider defendants, indicted alongside Buchanan, still face charges. These individuals include Ahmed Hossam Eldin Elbadawy, 24, a.k.a. "AD," of College Station, Texas; Evans Onyeaka Osiebo, 21, of Dallas, Texas; and Joel Martin Evans, 26, a.k.a. "joeleoli," of Jacksonville, North Carolina. The ongoing pursuit of these individuals demonstrates law enforcement’s commitment to dismantling the entire network.

Implications and the Future of Cybersecurity

The guilty pleas of Flowers and Jubair, particularly given their young age, serve as a stark reminder of the evolving landscape of cybercrime. The perceived youth of many Scattered Spider members often belies the sophistication and impact of their operations, challenging traditional notions of criminal profiles. Their ability to leverage social engineering, bypass advanced security measures like MFA, and exploit human vulnerabilities poses a persistent and significant threat to organizations worldwide.

These convictions send a powerful message of deterrence to other aspiring cybercriminals, emphasizing that despite the anonymity offered by the internet, law enforcement agencies possess the capabilities and international partnerships to track down and prosecute offenders. However, the fight is far from over. The prevalence of SIM-swapping, phishing, and ransomware attacks continues to highlight fundamental cybersecurity challenges, including the need for robust employee training, enhanced multi-factor authentication solutions resistant to social engineering, and rapid incident response capabilities.

For critical infrastructure operators like Transport for London, these incidents underscore the imperative for continuous investment in cybersecurity defenses, threat intelligence sharing, and resilient operational protocols to withstand and recover from sophisticated attacks. The potential for "serious damage to human welfare" is a sobering reminder that cyberattacks are no longer confined to the digital realm but have tangible, real-world consequences for public safety and societal functioning.

Owen Flowers and Thalha Jubair are scheduled to be sentenced in a London court on July 15, 2026. Their sentencing, alongside the ongoing prosecutions of other Scattered Spider members, will further solidify the legal framework for combating transnational cybercrime and hopefully contribute to a safer digital environment for individuals and organizations alike. The saga of Scattered Spider stands as a crucial case study in the relentless cat-and-mouse game between cybercriminals and law enforcement in the digital age.