Feds Tie ‘Scattered Spider’ Duo to $115M in Ransoms
– Krebs on Security U.S. prosecutors last week levied criminal hacking charges against 19-year-old U.K. national Thalha Jubair for allegedly being a core member of Scattered Spider, a prolific cybercrime group blamed for extorting at least $115 million in ransom payments from victims. The charges came as Jubair and an alleged co-conspirator appeared in a London court to face accusations of hacking into and extorting several large U.K. retailers, the London transit system, and healthcare providers in the United States. At a court hearing last week, U.K. prosecutors laid out a litany of charges against Jubair and 18-year-old Owen Flowers, accusing the teens of involvement in an August 2024 cyberattack that crippled Transport for London, the entity responsible for the public transport network in the Greater London area.
Alleged Scattered Spider member turns self in to Las Vegas police
| The Record from Recorded Future News Jonathan Greig September 22nd, 2025 A 17-year-old male surrendered to police in Las Vegas and was booked on charges related to 2023 cyberattacks against the city's casino and hospitality industry. A suspected member of the Scattered Spider cybercriminal organization turned themselves in to Las Vegas police last week under accusations that they were behind multiple cyberattacks targeting casinos in the city. The Las Vegas Metropolitan Police Department released a brief statement on Friday afternoon confirming that an unnamed juvenile suspect surrendered himself to the Clark County Juvenile Detention Center on September 17. He was booked on several charges related to cyberattacks on multiple Las Vegas casino properties between August 2023 and October 2023, police said. Those dates line up with ransomware attacks on Caesars Entertainment and MGM Resorts — both of which own multiple casinos and hotels across Las Vegas. Las Vegas Police said the attacks were attributed to Scattered Spider and noted that the FBI took over the investigation. The unnamed suspect was charged with three counts of obtaining and using the personal information of another person, one count of extortion, one count of conspiracy to commit extortion and one count of unlawful acts regarding computers. The Clark County District Attorney’s Office said it is looking to transfer the person to the criminal division, where he will face the charges as an adult. The ransomware attack on MGM Resorts cost the company more than $100 million and left thousands of Las Vegas visitors scrambling to deal with widespread technology outages caused by the incident. The attackers also stole sensitive personal information on millions of customers and employees. Members of the group later launched an assault in 2025 on multiple industries — shutting down several airlines, major insurance companies and high-profile retailers from March to July. The group most recently took credit for a damaging attack on British automotive giant Jaguar Land Rover. Law enforcement agencies have recently stepped up efforts to arrest, charge and convict members of the group. Last year, police in the U.K. arrested a 17-year-old for his alleged role in the MGM attack. Last week, a U.K. national was arrested in London and concurrently charged by U.S. prosecutors for his involvement in at least 120 attacks launched by Scattered Spider. Other members of the group were recently slapped with years-long prison sentences for launching attacks.
Two teenage suspected Scattered Spider members charged in UK over TfL hack
| The Record from Recorded Future News Alexander Martin September 18th, 2025 Two suspected members of the Scattered Spider cybercrime collective have been arrested and charged in the United Kingdom following an investigation into the hack of Transport for London (TfL) last year. The National Crime Agency (NCA) announced on Thursday that Thalha Jubair, 19, from East London, and Owen Flowers, 18, from Walsall, had been arrested at their homes at lunchtime on Tuesday. The Crown Prosecution Service authorized charges against both men on Wednesday night under the Computer Misuse Act, alleging they conspired to commit unauthorized acts against TfL, which was hacked in August 2024. Flowers had initially been arrested over the the transit agency attack in September 2024, but released on bail. The NCA said its officers also discovered additional potential evidence that Flowers had been involved in attacks against U.S. healthcare companies following his arrest. Flowers faces two additional charges of conspiring with others to infiltrate and damage the networks of SSM Health Care Corporation and attempting to do the same to Sutter Health. Jubair faces an additional charge for refusing to provide investigators with passcodes to access devices seized from him. The U.S. Department of Justice also unsealed a complaint against Jubair on Thursday, accusing him of computer crimes. The men are set to appear at Westminster Magistrates’ Court at 2 p.m. on Thursday. In England and Wales, criminal cases begin with a first hearing in a magistrates’ court where it is decided whether the case will proceed to a Crown Court for a jury trial — required for all cases where the sentence could exceed 12 months. The specific charges against both men are “conspiracy to commit an unauthorised act in relation to a computer causing / creating risk of serious damage to human welfare/national security,” the maximum sentence for which is life imprisonment. Magistrates’ courts also decide whether a defendant can be released on bail. Prosecutors are seeking to have both men remanded in custody until they can face trial. Paul Foster, the head of the NCA’s National Cyber Crime Unit, said: “Today’s charges are a key step in what has been a lengthy and complex investigation. This attack caused significant disruption and millions in losses to TfL, part of the UK’s critical national infrastructure.” It follows the NCA warning of an increasing threat from English-speaking cybercriminal groups, including the loose collective tracked as Scattered Spider, which has been associated with a range of attacks in both Britain and the United States. “The NCA, UK policing and our international partners, including the FBI, are collectively committed to identifying offenders within these networks and ensuring they face justice,” said Foster. Hannah Von Dadelszen, the CPS’ chief prosecutor for the Crown Prosecution Service, said: “Our prosecutors have worked to establish that there is sufficient evidence to bring the case to trial and that it is in the public interest to pursue criminal proceedings.” The charges come as the NCA’s cybercrime unit is understood to be busier than ever in investigating a range of cases. These include the hack against TfL, the Legal Aid Agency, two incidents impacting the National Health Service, and attacks on three retailers — Marks & Spencer, the Co-op, and the London-based luxury store Harrods. Contempt of court laws prohibit prejudicing a jury trial by suggesting suspects' guilt or innocence, publishing details regarding their past convictions, or speculating about the character of the defendants.
Four arrested by UK police over ransomware attacks on M&S, Co-op and Harrods
Four individuals in Britain were arrested early on Thursday morning by the National Crime Agency on suspicion of involvement in a range of ransomware attacks targeting the British retail sector earlier this year. The individuals are a 20-year-old British woman from Staffordshire, a 19-year-old Latvian male from the West Midlands, a 19-year-old British man from London and a 17-year-old British male from the West Midlands. All four are now in custody having been arrested at home, and the NCA said its officers have seized their electronic devices for forensic analysis. The individuals are suspected of involvement in three incidents in April impacting British retailers Marks & Spencer, the Co-op and the London-based luxury store Harrods. The NCA said the individuals are suspected of Computer Misuse Act offenses, blackmail, money laundering and participating in the activities of an organized crime group. “Since these attacks took place, specialist NCA cybercrime investigators have been working at pace and the investigation remains one of the Agency’s highest priorities,” said Paul Foster, the head of the NCA’s National Cyber Crime Unit. “Today’s arrests are a significant step in that investigation but our work continues, alongside partners in the UK and overseas, to ensure those responsible are identified and brought to justice. “Cyber attacks can be hugely disruptive for businesses and I’d like to thank M&S, Co-op and Harrods for their support to our investigations. Hopefully this signals to future victims the importance of seeking support and engaging with law enforcement as part of the reporting process. The NCA and policing are here to help.”
A 20-year-old man believed to be a member of the cybercrime ring known as Scattered Spider has pleaded guilty to charges brought against him in Florida and California. Noah Urban of Palm Coast, Florida, was arrested in January 2024 and charges against him were unsealed by US authorities in November 2024, when four others believed to be members of Scattered Spider were named.
