Two members of the Scattered Spider cybercrime gang pleaded guilty in a UK courtroom this week — on the very first day of what was supposed to be a six-week trial. Thalha Jubair, 20, and Owen Flowers, 18, admitted to criminal charges stemming from an August 2024 cyberattack that crippled Transport for London.
The pair admitted conspiring to commit unauthorized acts against TfL’s computer systems and causing risk of serious damage to human welfare. Flowers separately admitted involvement in hacking US healthcare providers SSM Health Care Corporation and Sutter Health in September 2024.
But the TfL hack is just one thread in a much larger story. US prosecutors in New Jersey unsealed an indictment in September 2025 alleging that Jubair and other Scattered Spider members committed computer fraud, wire fraud, and money laundering across 120 intrusions targeting 47 US entities between May 2022 and September 2025. Victims paid at least $115 million in ransoms.
The group’s résumé is staggering. They hit MGM Resorts and Caesars Entertainment in 2023, attacked UK retailers Marks & Spencer, Harrods, and the Co-op Group, and ran a thriving SIM-swapping operation through a Telegram channel called Star Chat. That operation used voice and SMS phishing to steal credentials from wireless carrier employees, then sold the ability to hijack victims’ phone numbers and intercept MFA codes.
Jubair, going by the handle “Rocket Ace,” allegedly co-ran Star Chat. At age 15, one of his aliases was “Everlynn” — a hacker who sold fraudulent “emergency data requests” using compromised police email addresses to demand subscriber data from tech companies.
The 2022 SMS phishing campaign attributed to the group compromised more than 130 organizations, including LastPass, DoorDash, Mailchimp, Plex, and Signal. Another member, Tyler Buchanan, pleaded guilty in April 2026 and is scheduled for sentencing in October. Florida’s Noah Urban was sentenced to 10 years and ordered to pay $13 million in restitution.
Flowers and Jubair are set to be sentenced in London on July 15, 2026. Three other alleged members still face charges in the US.
