Scattered Spider Hackers Plead Responsible on Day 1 of Trial – Krebs on Safety

Two males pleaded responsible in the UK this week to prison expenses stemming from an August 2024 cyberattack that crippled Transport for London, the entity answerable for the general public transport community within the Larger London space. The duo had been key members of a prolific cybercrime group referred to as Scattered Spider, and their responsible pleas got here on the primary day of what was anticipated to be a six-week trial.

Owen Flowers (left) 18, and Thalha Jubair, 20. Picture: UK Nationwide Crime Company (NCA).

Thalha Jubair, 20, of East London and 18-year-old Owen Flowers of Walsall admitted conspiring to commit unauthorized acts towards Transport for London laptop methods and inflicting threat of significant harm to human welfare. Based on a report from the BBC, Flowers alone admitted to being a part of a conspiracy to hack into U.S. based mostly healthcare suppliers SSM Well being Care Company and Sutter Well being in September 2024.

Jubair can be needed by U.S. regulation enforcement companies. In September 2025, prosecutors in New Jersey unsealed an indictment alleging Jubair and different Scattered Spider members dedicated laptop fraud, wire fraud, and cash laundering in relation to 120 laptop community intrusions involving 47 U.S. entities between Could 2022 and September 2025, and that the group’s victims paid at the very least $115 million in ransom funds.

In July 2025, KrebsOnSecurity reported that Flowers and Jubair had been arrested in the UK in reference to Scattered Spider ransom attacks towards the retailers Marks & Spencer and Harrods, and the British meals retailer Co-op Group. A number of sources aware of these investigations mentioned Flowers was the Scattered Spider member who anonymously gave interviews to the media within the days after the group’s September 2023 ransomware assaults disrupted operations at Las Vegas casinos operated by MGM Resorts and Caesars Leisure.

Based on prosecutors, Jubair co-ran a bustling Telegram channel known as Star Chat, the house of a SIM-swapping group that used voice- and SMS-based phishing assaults to steal credentials from workers on the main wi-fi suppliers within the U.S. and U.Okay. The group would then use that entry to promote a service that might redirect a goal’s cellphone quantity to a tool the attackers managed and intercept the sufferer’s calls and textual content messages (together with one-time codes for multi-factor authentication).

A receipt from Star Fraud Chat’s SIM-swapping service focusing on a T-Cell buyer after the group gained entry to inner T-Cell worker instruments. “Rocket Ace” was certainly one of Jubair’s hacker handles, in response to U.S. prosecutors.

New Jersey prosecutors additionally allege Jubair additionally was concerned in a mass SMS phishing campaign during the summer of 2022 that stole single sign-on credentials from workers at a whole lot of firms. That weeks-long SMS phishing marketing campaign led to intrusions and knowledge thefts at greater than 130 organizations, together with LastPass, DoorDash, Mailchimp, Plex and Sign.

KrebsOnSecurity reported final 12 months that certainly one of Jubair’s alter egos at age 15 was “Everlynn,” a hacker who bought fraudulent “emergency data requests” that used compromised police and authorities electronic mail addresses to demand subscriber knowledge (e.g. username, IP/electronic mail deal with) from main tech firms, claiming the requests involved pressing issues of life and dying and couldn’t watch for a courtroom order.

In April 2026, 24-year-old British nationwide and Scattered Spider member Tyler “Tylerb” Buchanan pleaded guilty to wire fraud conspiracy and aggravated id theft for collaborating within the group’s SMS phishing spree in the summertime of 2022. The federal government mentioned Buchanan, Jubair and others used the credentials harvested in that phishing marketing campaign to steal at the very least $8 million in cryptocurrency from victims all through america. Buchanan is presently scheduled to be sentenced on October 2.

In August 2025, 20-year-old Scattered Spider member from Florida named Noah Michael City was sentenced to 10 years in federal prison and ordered to pay $13 million in restitution, after pleading responsible to expenses of wire fraud and conspiracy.

The U.S. Division of Justice says three alleged Scattered Spider defendants indicted together with Buchanan nonetheless face expenses, together with Ahmed Hossam Eldin Elbadawy, 24, a.okay.a. “AD,” of Faculty Station, Texas; Evans Onyeaka Osiebo, 21, of Dallas, Texas; and Joel Martin Evans, 26, a.okay.a. “joeleoli,” of Jacksonville, North Carolina.

Flowers and Jubair are slated to be sentenced in a London courtroom on July 15, 2026.