Scattered Spider Hackers Plead Guilty on First Day of Trial – Krebs on Security
Two men pleaded guilty in the United Kingdom this week to criminal charges stemming from the August 2024 cyber attack that left them paralyzed. Transport for Londonthe business responsible for the public transport network in the Greater London area. The two were key members of a cyber crime syndicate known as Scattered spiderand their guilty pleas came on the first day of what was expected to be a six-week trial.
Owen Flowers (left) 18, and Thalha Jubair, 20. Picture: UK National Crime Agency (NCA).
Thalha Jubair20, from East London and an 18-year-old Owen’s Flowers of Walsall admitted conspiracy to commit unauthorized acts against Transport for London’s computer systems and create a risk of serious harm to public welfare. According to a BBC report, Flowers alone admitted that he was part of a conspiracy to defraud US healthcare providers SSM Health Care Corporation and Sutter Health in September 2024.
Jubair is also wanted by US authorities. In September 2025, prosecutors in New Jersey opened a case accusing Jubair and other members of Scattered Spider of committing computer fraud, wire fraud, and money laundering in connection with the intrusion of 120 computer networks involving 47 US organizations between May 2022 and September 2025, and the victims of 15 million rand paid at least the sum of the group’s money.
In July 2025, KrebsOnSecurity reported that Flowers and Jubair were arrested in the United Kingdom in connection with the Scattered Spider ransomware attack against merchants. Marks & Spencer again Harrodsand a British food retailer The Co-op Group. Multiple sources familiar with the investigation said Flowers was a Scattered Spider member who gave anonymous interviews to the media in the days after the group’s September 2023 ransomware attack disrupted operations at Las Vegas-owned casinos. MGM Restaurants again Caesars Entertainment.
According to prosecutors, Jubair joined a popular Telegram channel called Start a conversationhome of a SIM swapping group that uses voice and SMS-based phishing attacks to steal credentials from employees at major wireless providers in the US and UK The group will then use that access to sell a service that can redirect a target’s phone number to a device the attackers control and intercept the victim’s phone calls and text messages (including one-time verification codes).
A receipt from a Star Fraud Chat SIM exchange service directed at a T-Mobile customer after the party gained access to the tools of an internal T-Mobile employee. “Rocket Ace” was one of Jubair’s handles, according to US prosecutors.
New Jersey prosecutors also allege that Jubair also participated in a massive SMS phishing campaign in the summer of 2022 that stole the single login credentials of employees of hundreds of companies. That weeks-long phishing campaign led to the intrusion and theft of data from more than 130 organizations, including LastPass, DoorDash, Mailchimp, The Plex again The signal.
KrebsOnSecurity reported last year that one of Jubair’s 15-year-old alter egos “Everlynn,” a hacker selling fake “emergency data requests” that used compromised police and government email addresses to seek subscriber data (eg username, IP/email address) from major tech companies, made requests related to life-and-death emergencies and couldn’t wait for a court order.
In April 2026, the 24-year-old British member and member of Scattered Spider Tyler “Tylerb” Buchanan pleaded guilty to conspiracy to defraud and aggravated identity theft for participating in the group’s hacking campaign in the summer of 2022. The government said Buchanan, Jubair and others used information harvested in that phishing campaign to steal at least $8 million in cryptocurrency from victims across the United States. Buchanan is currently scheduled to be sentenced on October 2.
In August 2025, the 20-year-old Scattered Spider member from Florida named Noah Michael Urban he was sentenced to 10 years in federal prison and ordered to pay $13 million in restitution, after pleading guilty to fraud and conspiracy.
The US Department of Justice says the three Scattered Spider suspects indicted along with Buchanan are still facing charges, including Ahmed Hossam Eldin Elbadawy24, aka “AD,” of College Station, Texas; Evans Onyeaka Osiebo21, from Dallas, Texas; again Joel Martin Evans26, also known as “joeleoli,” from Jacksonville, North Carolina.
Flowers and Jubair are expected to be sentenced in a London court on July 15, 2026.
