A 19-year-old British teenager, Thalha Jubair, faces serious charges in the U.S. for his alleged involvement in over 120 cyberattacks, including crippling strikes on both public infrastructure and private companies.
Arrested at his East London home alongside 18-year-old Owen Flowers, Jubair is accused of taking part in a notorious hacking collective called Scattered Spider.
U.S. prosecutors allege that Jubair and his associates used social engineering techniques to infiltrate computer networks, steal data, encrypt systems, and demand ransom payments exceeding $115 million.
One of their high-profile attacks was against Transport for London (TfL) in 2024, which disrupted the city’s transport IT services, exposed thousands of passenger records, and cost close to £30 million to remedy. Both teenagers stand charged under the UK Computer Misuse Act for this cyberattack.
Additionally, Jubair is implicated in a 2025 breach of the U.S. Courts system, where hackers gained control of user accounts, including a federal magistrate judge’s, and used these to make fraudulent requests to a financial company for sensitive customer information.
Authorities seized servers linked to Jubair that housed cryptocurrency wallets containing about $36 million, though it is suspected that Jubair moved approximately $8.4 million from these funds as law enforcement closed in.
The combined charges include conspiracy to commit computer fraud, wire fraud, and money laundering, carrying a potential prison sentence of up to 95 years. The Department of Justice has not yet disclosed if extradition will be pursued.
The National Crime Agency called this arrest a vital step in their investigation into Scattered Spider, which consists largely of teenage hackers employing simple yet effective methods like impersonating employees to manipulate IT support systems.
The FBI condemned such attacks, emphasising their commitment to bringing offenders to justice, no matter where they hide.