TWO men have pleaded guilty in the UK to charges stemming from a cyberattack on Transport for London and attempted intrusions at US healthcare providers, prosecutors said according to KrebsOnSecurity. Thalha Jubair, aged 20, and Owen Flowers, aged 18, admitted their roles in the Scattered Spider cybercrime group.
The attack on TfL began on 31 August 2024 and caused three months of disruption, resulting in a £39 million loss and affecting around ten million customers as reported by DataBreaches.net. Investigators said the intrusion relied heavily on SIM‑swapping tactics and a large‑scale phishing campaign that harvested credentials from dozens of organisations.
Prosecutors allege that Jubair co‑managed a SIM‑swapping ring and led the phishing effort that compromised more than 130 companies, leading to significant data breaches. Flowers separately confessed to attempting to hack Sutter Health and SSM Healthcare Corporation in the United States, adding a transatlantic dimension to the plea.
Scattered Spider has been linked to a string of ransomware and extortion schemes, with total demands from the group estimated at no less than $115 million. Other members of the collective have faced similar charges in recent months, underscoring the persistent threat posed by the network.
Sentencing for Flowers and Jubair is scheduled for 15 July 2026 at Woolwich Crown Court. While the immediate legal process is concluding, investigators warn that the broader Scattered Spider infrastructure remains active and could launch new operations.
Defenders should treat SIM‑swapping alerts as a high‑priority indicator, enforce strict multi‑factor authentication policies that resist social engineering, and regularly review phishing detection rules to catch credential‑harvesting lags. Network segmentation and privileged‑access monitoring are also essential to limit lateral movement if an attacker does gain a foothold.