Day one of what prosecutors had scheduled as a six-week UK trial ended before opening arguments started. Thalha Jubair, 20, and Owen Flowers, 18, admitted at Woolwich Crown Court on June 22 to conspiring to commit unauthorized computer access against Transport for London’s transit network in an August 2024 attack that cost the agency £29 million in losses and recovery costs.
Flowers separately admitted hacking SSM Health Care Corporation and Sutter Health in September 2024. Jubair carries more exposure than a single UK conviction: a New Jersey indictment unsealed September 2025 alleges he and other Scattered Spider members committed 120 network intrusions against 47 U.S. entities, with victims paying over $115 million in ransom between May 2022 and September 2025. Prosecutors also allege Jubair co-ran Star Chat, a Telegram channel that sold redirected phone numbers to bypass multi-factor authentication at major wireless carriers.
The 2022 SMS phishing campaign prosecutors attribute to Jubair’s group hit more than 130 organizations, including LastPass, DoorDash, and Signal. At 15, Jubair allegedly ran as “Everlynn,” selling fraudulent emergency data requests to extract subscriber data from tech companies without a court order.
Scattered Spider’s prosecution arc is closing fast. Noah Urban was sentenced to 10 years and $13 million restitution in August 2025, setting the floor on U.S. outcomes. Tyler Buchanan pleaded guilty in April 2026 to wire fraud conspiracy, with sentencing scheduled October 2. The UK guilty pleas on Day 1 avoid what would’ve been a complex cross-jurisdictional evidentiary fight — and hand prosecutors convictions they didn’t have to earn at trial.
Flowers and Jubair face sentencing at Woolwich Crown Court on July 16. Three defendants charged alongside Buchanan in the U.S. indictment haven’t resolved their cases yet.
Rebecca Lauren