Criminal Duo Plead Guilty to London Transport Cyberattack

Owen Flowers, 18, and Thalha Jubair, 20, pleaded guilty in a United Kingdom court to charges stemming from an August 2024 cyberattack on Transport for London. Members of the Scattered Spider cybercrime group, they admitted to conspiring to commit unauthorized acts against the network’s computer systems, according to court proceedings.

The guilty pleas occurred on the first day of a trial that prosecutors expected to last six weeks. Flowers, of Walsall, and Jubair, of East London, admitted to causing a risk of serious damage to human welfare through their actions against the entity responsible for the Greater London public transport network. A London court has scheduled their sentencing for July 15, 2026.

What other attacks are Flowers and Jubair linked to?

The two defendants are tied to a string of international intrusions targeting healthcare, retail, and gaming sectors. According to the BBC, Flowers admitted to conspiring to hack U.S.-based healthcare providers Sutter Health and SSM Health Care Corporation in September 2024.

Jubair faces separate legal challenges in the United States. New Jersey prosecutors unsealed an indictment in September 2025 alleging Jubair and other Scattered Spider members committed money laundering, wire fraud, and computer fraud. That indictment links the group to 120 computer network intrusions involving 47 U.S. entities between May 2022 and September 2025, with victims paying at least $115 million in ransom.

In July 2025, KrebsOnSecurity reported that Flowers and Jubair were arrested in the U.K. for ransomware attacks against Harrods, Marks & Spencer, and the Co-op Group. Sources familiar with those investigations told KrebsOnSecurity that Flowers was the member who gave anonymous media interviews following the September 2023 attacks on Caesars Entertainment and MGM Resorts in Las Vegas.

How did the Scattered Spider group operate?

The group relied heavily on social engineering and the theft of employee credentials to bypass security. Prosecutors stated Jubair co-ran a Telegram channel called Star Chat, which operated as a hub for SIM-swapping. This technique uses SMS- and voice-based phishing to steal credentials from wireless provider employees, allowing attackers to redirect a target’s phone number to their own device and intercept multi-factor authentication codes.

Jubair’s activity began at a young age. KrebsOnSecurity reported that at 15, Jubair used the alias Everlynn to sell fraudulent emergency data requests. These requests used compromised government and police email addresses to trick tech companies into releasing subscriber data, such as IP addresses and usernames, by claiming the matter was a life-and-death emergency.

The group also executed large-scale phishing campaigns. New Jersey prosecutors allege Jubair participated in a mass SMS phishing effort in the summer of 2022 that targeted hundreds of companies. This campaign led to data thefts and intrusions at more than 130 organizations, including:

• Signal
• Mailchimp
• DoorDash
• Plex
• LastPass

What are the legal outcomes for other group members?

Several other members of Scattered Spider have faced U.S. federal prosecution. In August 2025, Noah Michael Urban, 20, of Florida, was sentenced to 10 years in prison and ordered to pay $13 million in restitution after pleading guilty to conspiracy and wire fraud.

Tyler Buchanan, 24, a British national, pleaded guilty in April 2026 to aggravated identity theft and wire fraud conspiracy. According to the government, Buchanan and Jubair used credentials from the 2022 phishing campaign to steal at least $8 million in cryptocurrency. Buchanan is scheduled for sentencing on October 2.

The U.S. Department of Justice indicates that three other indicted defendants are still facing charges: Joel Martin Evans of Jacksonville, North Carolina; Evans Onyeaka Osiebo of Dallas, Texas; and Ahmed Hossam Eldin Elbadawy of College Station, Texas.