Two young men accused of taking part in a cyberattack on Transport for London changed their pleas at the start of a trial that had been expected to run for six weeks.
Thalha Jubair, 20, from East London, and Owen Flowers, 18, from Walsall, pleaded guilty in the United Kingdom this week to charges connected to an August 2024 intrusion into Transport for London systems, according to KrebsOnSecurity and the BBC. TfL runs the public transport network across Greater London, so this was not some throwaway website defacement. Prosecutors accused the pair of conspiring to carry out unauthorized activity against TfL computers and creating a risk of serious harm to human welfare.
The BBC reported that Flowers also admitted taking part in a separate conspiracy to break into the systems of U.S.-based healthcare organizations SSM Health Care Corporation and Sutter Health in September 2024.
KrebsOnSecurity identified Jubair and Flowers as key members of Scattered Spider, a cybercrime group associated with social engineering, credential theft, SIM-swapping and ransomware operations. The group’s usual tradecraft is less movie hacking than help-desk abuse: trick employees, steal logins, defeat weak identity checks, then use legitimate access to do illegitimate things.
Jubair also faces attention from U.S. prosecutors. In September 2025, federal prosecutors in New Jersey unsealed an indictment accusing him and other alleged Scattered Spider members of computer fraud, wire fraud and money laundering. The indictment alleged 120 network intrusions affecting 47 U.S. entities between May 2022 and September 2025, and said victims paid at least $115 million in ransom.
KrebsOnSecurity reported in July 2025 that Flowers and Jubair had been arrested in the U.K. in connection with Scattered Spider ransomware attacks on Marks & Spencer, Harrods and Co-op Group. The same report said multiple people familiar with those investigations identified Flowers as the group member who anonymously spoke to reporters after the September 2023 ransomware attacks that disrupted MGM Resorts and Caesars Entertainment casino operations in Las Vegas.
U.S. prosecutors have also described Jubair as a co-operator of Star Chat, a Telegram channel tied to SIM-swapping. According to prosecutors, the group used voice and SMS phishing to steal credentials from employees at large mobile carriers in the U.S. and U.K. With access to internal carrier tools, attackers could redirect a victim’s phone number to a device they controlled, letting them receive calls and texts meant for the target, including one-time authentication codes.
New Jersey prosecutors further allege Jubair took part in a large SMS phishing campaign in summer 2022 that stole single sign-on credentials from employees at hundreds of companies. KrebsOnSecurity reported that the campaign led to intrusions and data theft at more than 130 organizations, including LastPass, DoorDash, Mailchimp, Plex and Signal.
KrebsOnSecurity has also reported that Jubair, at age 15, used the handle “Everlynn” and sold fraudulent emergency data requests. Those requests allegedly used compromised police and government email accounts to pressure technology companies into handing over subscriber data without waiting for a court order.
Other Scattered Spider cases are already moving through U.S. courts. In April 2026, British national Tyler “Tylerb” Buchanan pleaded guilty to wire fraud conspiracy and aggravated identity theft over the 2022 SMS phishing campaign. Prosecutors said Buchanan, Jubair and others used stolen credentials to take at least $8 million in cryptocurrency from U.S. victims. Buchanan is scheduled for sentencing on October 2.
In August 2025, Florida resident Noah Michael Urban was sentenced to 10 years in federal prison and ordered to pay $13 million in restitution after pleading guilty to wire fraud and conspiracy charges. The U.S. Justice Department says three other defendants indicted with Buchanan still face charges: Ahmed Hossam Eldin Elbadawy of College Station, Texas; Evans Onyeaka Osiebo of Dallas; and Joel Martin Evans of Jacksonville, North Carolina.
Flowers and Jubair are due to be sentenced in London on July 15, 2026.
This story draws on original reporting from Krebs on Security.
