Spanish police have arrested UK citizen Joseph O'Connor at the US' request over his alleged involvement in last year's hack of high-profile Twitter accounts
Authorities are still cracking down on participants in the July 2020 — Twitter celebrity hacks. Spanish National Police have
Context & Ripple Effects
Days after Krebs on Security linked the July 2020 takeover of accounts including Biden's, Obama's, and @jack's to a young English SIM swapper, Spanish National Police detained that suspect — Joseph O'Connor — acting at the US' request. The arrest turned an anonymous attribution claim into a live extradition case.
It also opened a multi-year legal arc the related coverage tracks end to end: Spain's High Court later approved his extradition, he pleaded guilty under his PlugwalkJoe alias, and a US federal court handed down a five-year sentence — while Spanish police kept raiding suspected hackers as recently as a 2025 operation over 40 attacks on critical organizations.
First-order effects
- O'Connor moves from free movement in Spain to US custody pending extradition, facing charges tied to the compromise of dozens of high-profile Twitter accounts.
- Spanish National Police gain a template case for acting on foreign law-enforcement requests against UK citizens resident or transiting in Spain.
Second-order effects
- SIM-swap crews behind celebrity account takeovers learn that pseudonymous handles like PlugwalkJoe no longer insulate them once attribution reporting is followed by arrests abroad.
- Spain's willingness to execute repeated raids and seizures of crypto accounts positions it as a recurring launch point for US-directed cybercrime takedowns.
Third-order effects
- If the pattern holds, platform account-takeover incidents follow a security-to-policy pipeline: a breach of verified VIP accounts becomes the evidence base for cross-border policing norms around SIM swapping and social-engineering crime.
- Extradition-plus-plea sequences like this one push hacking groups toward jurisdictions without US treaties, reshaping where such operators can safely operate.
The trend: SIM-swap crews that hijacked celebrity social media accounts are being identified, extradited, and imprisoned across borders years after their attacks, closing the anonymity gap they relied on.