The US DOJ charges a UK teen allegedly tied to Scattered Spider over 120+ cyberattacks and the UK charged him and another teen over a Transport for London hack

The 19-year-old is alleged to have extracted $115mn in ransom payments from victims — A British teenager has been charged …

Financial Times 2025-09-19 Kieran Smith

Context & Ripple Effects

This action extends a cross-border enforcement arc that already included a UK-US arrest of a teenager suspected of links to the MGM Resorts ransomware attack. It puts alleged Scattered Spider activity under simultaneous US and UK legal scrutiny rather than treating the cases as isolated incidents.

Later coverage shows the Transport for London case moving from charges to guilty pleas by two alleged members and then sentencing, giving this earlier charging action added significance as part of a sustained case-building effort against the group.

First-order effects

The accused faces US allegations spanning more than 120 cyberattacks alongside UK charges connected to the Transport for London incident, increasing his immediate legal exposure across two jurisdictions.
DOJ and UK investigators can pursue the alleged conduct through separate but related cases, concentrating attention on the group’s claimed ransomware proceeds and operational activity.

Second-order effects

Parallel proceedings raise the cost for alleged associates of operating across borders: evidence, defendants, and investigative leads in one case can support scrutiny in the other.
Victims and organizations targeted by similar intrusion-and-extortion campaigns gain a clearer enforcement counterpart, while law-enforcement agencies have more reason to coordinate attribution and case development.

Third-order effects

If this pattern continues, ransomware enforcement will increasingly target networks through coordinated national prosecutions rather than relying on a single country to carry the case.
The later pleas and sentences in the TfL matter suggest that the strategic test is not merely making arrests, but converting cross-border investigations into durable convictions.

The trend: Scattered Spider coverage reflects a broader shift toward coordinated cross-border prosecution of cybercrime groups and their alleged participants.

Discussion

@nca_uk @nca_uk on x
Two men have been charged as part of the NCA investigation into a cyber attack on Transport for London (TfL). Read the full story ➡️ https://www.nationalcrimeagency.gov.uk/ ... @CityPolice [image]
@citypolice @citypolice on x
Last year @TfL were the subject of a cyber attack which caused significant disruption to their services. Following a complex investigation involving the City of London Police, @NCA_UK has today brought charges against two individuals in relation to the incident. [image]
@vxunderground @vxunderground on x
Chat, I'm not a crypto nerd. In this Scattered Spider court document, they state Mr. Jubair a/k/a Earth2Star received approx. 920.16BTC from performing ransomware attacks. How difficult is it to safely launder 920.16BTC? (approx. $108,062,646 as of this writing) [image]
@vxunderground @vxunderground on x
DAWG. They social engineered the United States judicial system (???), reset someone's password by pretending to be helpdesk, and LOOKED THEMSELVES UP [image]
@vxunderground @vxunderground on x
Dawg, one of the Scattered Spider guys ransomed a bunch of companies, made $36,000,000, then used the money for Uber Eats and Steam 😭 They had him from Uber Eats bro 😭 [image]
@racheltobac Rachel Tobac on x
Huge Scattered Spider arrest today — 19 years old, in the UK, & allegedly committed 120 intrusions, extorted 47+ U.S. orgs for $115 Million in ransom. If convicted, a potential 95 years in prison. A definite “tell us everyone involved or you'll die in a cell” attempt here.
@dojcrimdiv @dojcrimdiv on x
United Kingdom National Charged in Connection with Multiple Cyber Attacks, Including on Critical Infrastructure “Jubair is alleged to have participated in a sweeping cyber extortion scheme carried out by a group known as Scattered Spider, which committed at least 120 attacks [ima…
@vxdb @vxdb on x
The UK's National Crime Agency has announced the arrest of two suspected members of the Scattered Spider group in connection with last year's hack of Transport for London. Thalha Jubair, 19, from East London, and Owen Flowers, 18, from Walsall, were taken into custody at their
@fbi @fbi on x
Today, the FBI and @TheJusticeDept announced charges against UK national Thalha Jubair, who was arrested on Tuesday for alleged participation in a sweeping cyber extortion scheme by the Scattered Spider criminal group. Jubair and his associates were involved in approximately [ima…
@vxunderground @vxunderground on x
HOLY FUCK. Department of Justice nabbed one of the Scattered Spider guys. They got him on 120 counts of computer intrusions. He's facing over 95 years in prison. I've NEVER seen a cyber crime charge this high. [image]
@vxunderground @vxunderground on x
Oh my goodness, I guess the image is too blurry. I received this image last year when someone who was (probably) in Scattered Spider claimed to have compromise critical infrastructure in the United Kingdom. Specifically, this is access (allegedly) to Transport For London.
@vxunderground @vxunderground on x
I received this image quite some time ago. I've been sitting on it. Staring at it. Contemplating the duality of life. Can anyone guess what this image is? [image]
@zackwhittaker@mastodon.social Zack Whittaker on mastodon
My dispatch on the DOJ charges unsealed today against a UK teenager accused of being prolific hacker in the Scattered Spider group. Prosecutors say Thalha Jubair, 19, was involved in at least 120 cyberattacks, including the U.S. Courts system, and the extortion of dozens of U.S.…
r/cybersecurity r on reddit
‘Scattered Spider’ teens charged over London transportation hack

Chronicles