Federal prosecutors in the United States charged Thalha Jubair, a 19-year-old in London, with conspiracy to commit computer fraud and related offenses tied to intrusions at 47 US companies that yielded more than $115 million in ransomware payments over a three-year period.
A criminal complaint unsealed on Thursday describes Jubair as a member of Scattered Spider, an English-speaking ransomware group that has breached networks worldwide and pressured victims to pay large ransoms or have stolen data published or sold.
The document notes investigators recovered bitcoin payments made by victims, and it was filed in the US District Court for the District of New Jersey. The filing coincided with UK prosecutors charging Jubair’s fellow member, Owen Flowers, 18, of Walsall, in connection with last year’s cyberattack on Transport for London.
Transport for London, London’s public transit operator, faced a months-long recovery after the breach. Flowers, who had been previously arrested in September 2024 and later released, is also connected to the TfL case, according to Britain’s National Crime Agency. Officials said Flowers and other conspirators were also tied to a cyberattack on SSM Health Care and attempts to breach Sutter Health in the United States.
Jubair was additionally charged in the United States for refusing to turn over PIN codes and passwords for devices seized from him, the complaint states.
The U.S. Justice Department alleges the Scattered Spider operation conducted about 120 cyberattacks against 47 US companies; investigators said five victims paid roughly $89.5 million in bitcoin as part of the scheme. If convicted, Jubair faces decades in prison, with potential penalties that could reach up to 95 years in prison on multiple counts.
