A pair of defendants entered guilty pleas this week in the United Kingdom on charges connected to an August 2024 incident that disrupted operations at Transport for London, which manages public transportation across the Greater London region. Both individuals held prominent roles within Scattered Spider, a prolific criminal hacking organization, and their admissions occurred on the opening day of proceedings that had been anticipated to span six weeks.
Thalha Jubair, aged 20 and based in East London, and Owen Flowers, 18, from Walsall, each admitted to involvement in a conspiracy to execute unauthorized operations against Transport for London's computer infrastructure and to create a risk of severe harm to public safety. According to reporting by the BBC, Flowers separately acknowledged participation in a conspiracy targeting U.S. healthcare organizations SSM Health Care Corporation and Sutter Health during September 2024.
U.S. law enforcement authorities are also seeking Jubair. In September 2025, prosecutors in New Jersey unsealed charges alleging that Jubair and fellow Scattered Spider operatives engaged in computer fraud, wire fraud, and money laundering across 120 intrusions of computer networks belonging to 47 U.S. organizations spanning May 2022 through September 2025, with victims having paid no less than $115 million in ransom demands.
During July 2025, KrebsOnSecurity disclosed that Flowers and Jubair had been apprehended in the United Kingdom in relation to Scattered Spider extortion operations targeting the retail chains Marks & Spencer and Harrods, as well as the British grocery company Co-op Group. Individuals with knowledge of the investigations indicated that Flowers served as the Scattered Spider operative who provided anonymous media interviews immediately following the group's September 2023 ransomware campaign that disrupted MGM Resorts and Caesars Entertainment casino operations in Las Vegas.
SIM-Swapping and Phishing Operations
According to prosecutors' allegations, Jubair managed a Telegram channel designated Star Chat, which functioned as the operational base for a SIM-swapping collective. This group deployed voice and SMS-based phishing tactics to compromise employee credentials at major telecommunications carriers in both the U.S. and U.K., subsequently offering a service capable of redirecting a target's phone number to attacker-controlled devices and capturing incoming calls and messages, including one-time authentication codes.
New Jersey prosecutors further contend that Jubair participated in a widespread SMS phishing operation during summer 2022 that harvested single sign-on credentials from personnel at hundreds of enterprises. This multi-week campaign resulted in breaches and information theft affecting more than 130 organizations, among them LastPass, DoorDash, Mailchimp, Plex, and Signal.
According to prior reporting by KrebsOnSecurity, one of Jubair's online identities at age 15 was "Everlynn," a hacker engaged in selling fraudulent "emergency data requests" that leveraged compromised law enforcement and government email accounts to solicit subscriber information (including usernames, IP addresses, and email addresses) from major technology firms, falsely claiming the requests involved urgent life-or-death circumstances that could not await judicial authorization.
Additional Guilty Pleas and Sentencing
During April 2026, Tyler "Tylerb" Buchanan, a 24-year-old British national and Scattered Spider participant, entered guilty pleas to wire fraud conspiracy and aggravated identity theft charges for involvement in the organization's SMS phishing campaign of summer 2022. The government asserted that Buchanan, Jubair, and associates leveraged credentials obtained through that phishing initiative to steal at least $8 million in cryptocurrency from U.S. victims. Buchanan faces sentencing scheduled for October 2.
In August 2025, Noah Michael Urban, a 20-year-old Scattered Spider member from Florida, received a 10-year federal prison sentence and was ordered to remit $13 million in restitution following guilty pleas to wire fraud and conspiracy charges.
Outstanding Charges
The U.S. Department of Justice indicates that three additional alleged Scattered Spider defendants charged alongside Buchanan remain subject to prosecution. These individuals include Ahmed Hossam Eldin Elbadawy, 24, known as "AD" and residing in College Station, Texas; Evans Onyeaka Osiebo, 21, of Dallas, Texas; and Joel Martin Evans, 26, also known as "joeleoli," from Jacksonville, North Carolina.
Flowers and Jubair are scheduled to receive sentencing determinations in a London court on July 15, 2026.
Source: Krebs on Security