Scattered Spider hackers plead guilty on first day of trial, UK courts set sentencing

2 Min Read

Scattered Spider hackers admit guilt as UK trial opens

Two young men, 18‑year‑old Owen Flowers and 20‑year‑old Thalha Jubair, entered guilty pleas in London this week for the August 2024 ransomware strike that crippled Transport for London. Flowers confessed to conspiring against TfL’s IT infrastructure and to a separate plot targeting U.S. health‑care firms SSM Health and Sutter Health. Jubair faces parallel charges in the United States, where a New Jersey indictment links him to a ↓ $115 million ransom scheme that hit 47 American entities between 2022 and 2025. British authorities previously tied the pair to ransom attacks on Marks & Spencer, Harrods and the Co‑op Group, as reported by Reuters. Prosecutors say Jubair co‑ran the Telegram “Star Chat” channel, facilitating SIM‑swap phishing that harvested credentials from major carriers in both the U.K. and the U.S. A leaked receipt shows the group redirecting a T‑Mobile customer’s number to a device under their control. Security analysts note the operation mirrors the 2023 Las Vegas casino disruptions that the duo publicised through anonymous media interviews. In the United States, a related defendant, Tyler “Tylerb” Buchanan, recently pleaded guilty to a summer‑2022 SMS phishing campaign that siphoned ↑ $8 million in cryptocurrency, a scheme that also involved Jubair. Other alleged members—including Noah Michael Urban, sentenced to ten years and $13 million restitution—remain under federal watch. The London sentencing for Flowers and Jubair is scheduled for 15 July 2026. The case underscores how pandemic‑era remote‑work vulnerabilities continue to fuel trans‑national cybercrime, a trend explored in our pandemic analysis.

Words by Kaelen Frost (Lead Cybersecurity Analyst).