Scattered Spider
English-speaking cybercrime collective; one of the most prolific ransomware groups of 2023-2025.
Two Scattered Spider members, Owen Flowers and Thalha Jubair, were jailed for five years and six months each on 16 July 2026 over the attack on Transport for London, which the National Crime Agency called Britain's largest cybercrime prosecution.
Last refreshed: 12 October 2026 · Appears in 1 active topic
How many Scattered Spider members have been charged, and is the group still operating?
Timeline for Scattered Spider
Mentioned in: Astrana Health files 8-K over phone spoof
Cybersecurity: Threats and DefencesMentioned in: ICO reprimands ACRO over patching failures
Cybersecurity: Threats and DefencesSupplied the helpdesk-social-engineering playbook used in the attack
Cybersecurity: Threats and Defences: TfL hackers jailed five and a half yearsMentioned in: Police press for a 'digital prison'
Cybersecurity: Threats and DefencesMentioned in: World Leaks posts 630GB stolen from Tata
Cybersecurity: Threats and DefencesBackground
Scattered Spider is an English-speaking cybercrime collective active since at least 2022. Its EDGE is social engineering: members phone corporate helpdesks posing as staff to reset credentials, bypass multi-factor authentication or obtain SIM swaps, then move through identity systems before deploying ransomware or stealing data. Membership is fluid and organised over Telegram and Discord. The FBI assessed it as one of the most prolific threat actors hitting US companies in 2023-2025.
Its best-known attacks were the September 2023 ransomware campaigns against MGM Resorts and Caesars Entertainment; Caesars reportedly paid a $15m ransom. In September 2024 the same playbook disabled 148 Transport for London systems and exposed data on about 10 million passengers. On 16 July 2026 Woolwich Crown Court jailed Owen Flowers and Thalha Jubair for five years and six months each over that attack. Flowers had been arrested while hacking two US healthcare providers. City of London Police then pressed for new Cyber Crime Risk Orders to restrict convicted hackers' devices after release.
Enforcement has reached members abroad. Peter Stokes ('Bouquet'), 19, a dual US-Estonian citizen, was arrested at Helsinki airport on 10 April 2026; US charges unsealed on 28 April allege he took part in at least four breaches, and the US is seeking his extradition to Chicago.