Two key figures within the prolific cybercrime collective **Scattered Spider** have pleaded guilty in the United Kingdom to criminal charges related to an August 2024 cyberattack that severely impacted **Transport for London** (TfL), the entity overseeing Greater London's public transport network. **Thalha Jubair**, 20, of East London, and **Owen Flowers**, 18, of Walsall, admitted to conspiring to commit unauthorized acts against TfL computer systems and causing a risk of serious damage to human welfare. Their guilty pleas came on what was slated to be the opening day of a six-week trial.  ### Broader Conspiracy and U.S. Connections Beyond the TfL incident, Flowers also confessed to involvement in a conspiracy to hack U.S.-based healthcare providers **SSM Health Care Corporation** and **Sutter Health** in September 2024, according to a report from the BBC. Jubair faces further legal challenges, as U.S. law enforcement agencies have an outstanding indictment against him. Unsealed in September 2025 by New Jersey prosecutors, the indictment alleges Jubair and other **Scattered Spider** members committed computer fraud, wire fraud, and money laundering across 120 computer network intrusions involving 47 U.S. entities between May 2022 and September 2025. The group's victims reportedly paid at least $115 million in ransom payments. In July 2025, Flowers and Jubair were arrested in the UK in connection with **Scattered Spider** ransomware attacks against British retailers **Marks & Spencer**, **Harrods**, and the **Co-op Group**. Sources familiar with these investigations indicated that Flowers was the **Scattered Spider** member who anonymously gave media interviews following the group's September 2023 ransomware attacks that disrupted operations at Las Vegas casinos operated by **MGM Resorts** and **Caesars Entertainment**. ### The Mechanics of Deception: SIM-Swapping and Phishing Prosecutors revealed that Jubair co-managed **Star Chat**, a bustling Telegram channel dedicated to SIM-swapping operations. This group employed voice- and SMS-based phishing attacks to steal credentials from employees at major wireless providers in both the U.S. and U.K. With this illicit access, they offered a service to redirect target phone numbers to attacker-controlled devices, enabling the interception of calls and text messages, including crucial multi-factor authentication (MFA) codes.  New Jersey prosecutors also implicated Jubair in a widespread SMS phishing campaign during the summer of 2022. This weeks-long operation stole single sign-on credentials from employees at hundreds of companies, leading to intrusions and data thefts at over 130 organizations, including **LastPass**, **DoorDash**, **Mailchimp**, **Plex**, and **Signal**. Furthermore, at just 15, Jubair, under the alias **Everlynn**, was reportedly involved in selling fraudulent “emergency data requests.” These requests leveraged compromised police and government email addresses to demand subscriber data (such as usernames, IP addresses, and email addresses) from major tech companies, falsely claiming urgent matters of life and death to bypass standard legal processes. ### Other Scattered Spider Members Face Justice The legal repercussions for **Scattered Spider** members are mounting: * In April 2026, **Tyler “Tylerb” Buchanan**, a 24-year-old British national, pleaded guilty to wire fraud conspiracy and aggravated identity theft for his role in the group’s 2022 SMS phishing spree. Buchanan, Jubair, and others allegedly used harvested credentials to steal at least $8 million in cryptocurrency. Buchanan is scheduled for sentencing on October 2. * In August 2025, **Noah Michael Urban**, a 20-year-old **Scattered Spider** member from Florida, was sentenced to 10 years in federal prison and ordered to pay $13 million in restitution after pleading guilty to wire fraud and conspiracy charges. The U.S. Department of Justice has also indicted three other alleged **Scattered Spider** defendants who still face charges: **Ahmed Hossam Eldin Elbadawy**, 24, a.k.a. “AD,” of College Station, Texas; **Evans Onyeaka Osiebo**, 21, of Dallas, Texas; and **Joel Martin Evans**, 26, a.k.a. “joeleoli,” of Jacksonville, North Carolina. Flowers and Jubair are slated for sentencing in a London court on July 15, 2026.