News in Brief: Suspect charged over ransomware attacks on healthcare, education, and more
It’s taken a while, and the suspect may never face court, but he’s been charged anyway.
Two more members of the notorious cybercrime gang going by Scattered Spider are now facing the consequences of their actions.
If UK news site The Guardian has it right, however, they’ll almost certainly be out of prison before they’re in their mid-20s, each with more money stashed away in the form of cryptocoins than the vast majority of us will see in our lifetimes.
Earlier this month, we wrote up the case of Peter Stokes, allegedly another Scattered Spider criminal, who was extradited to the US in April 2026 to face serious charges related to cyberextortion – supposedly breaking into a company, stealing nearly 100GB of data, and then demanding payment of $8,000,000 to “make the stolen data go away.”
Stokes, now just 19, is said to have been making money from cybercrime hand-over-fist since he was about 17, allegedly funding his own luxury travel to Paris, Italy, Spain, Germany, New York, Florida, New Mexico, Thailand, and Dubai – almost unimaginable wealth for someone his age.
The criminals in this case are also astonishingly young.
As they start the five-and-a-half year prison sentences handed down to them today, Thalha Jubair is 20 and Owen Flowers just 19.
In fact, the main cyberattack in their case – both waited until their trial was about to start, presumably to see how strong the prosecution’s case looked, and then pleaded guilty – took place nearly two years ago, and seriously affected the operations of Transport for London (TfL), which runs London’s vital and widely-used public transport network.
Flowers, it seems, managed to avoid Stokes’s fate of extradition to the US, despite being wanted for cybercrimes against two American healthcare organizations, by having his US charges processed in the UK as part of this case.
Convicted cybercriminals don’t always get to settle their charges on those terms – hyperactive Canadian ransomware criminal Sebastien Vachon-Desjardins, for example, went to prison for seven years in Canada, was released almost at once so he could be extradited to the US, where he is now serving a 20-year sentence, after which he will be deported back to Canada to finish the leftover part of his 7-stretch.
As for that retirement-level wealth that Jubair and Flowers may already have stashed away for their lives after incarceration, the Guardian notes that:
A previous hearing was told that $10,000,000 was moved from Jubair’s crypto wallets after he was released from custody in March [2025] and $200,000,000-worth of crypto had also moved through accounts belonging to him.
An earlier hearing was also told that Flowers held $7.1m, including crypto, in accounts he controlled, despite having no source of income.
Jubair apparently had 22 previous criminal convictions as a teenager, including “13 counts of fraud, two of unauthorized access to a computer, one of obtaining access to a computer, and one of blackmail. He had also been convicted in a youth court of stalking two young women and hacking into a City of London police server.”
Flowers was also “known to police,” as British English splendidly puts it, and when he turned 16 was apparently offered rehabilitation aimed at steering him away from online crime.
He declined the rehabilitation, which doesn’t seem terribly surprising given that it seems he had accumulated more than $7,000,000 in assets by the time he was charged with the TfL hack just two years later.
No audio player showing above? Try clicking here to listen in a new browser tab, or read the full transcript instead.
Why not ask how SolCyber can help you do cybersecurity in the most human-friendly way? Don’t get stuck behind an ever-expanding convoy of security tools that leave you at the whim of policies and procedures that are dictated by the tools, even though they don’t suit your IT team, your colleagues, or your customers!
Paul Ducklin is a respected expert with more than 30 years of experience as a programmer, reverser, researcher and educator in the cybersecurity industry. Duck, as he is known, is also a globally respected writer, presenter and podcaster with an unmatched knack for explaining even the most complex technical issues in plain English. Read, learn, enjoy!
It’s taken a while, and the suspect may never face court, but he’s been charged anyway.
Many small and mid-sized enterprises (SMEs) choose not to invest in cybersecurity early on, and it’s understandable why, given its impact to the bottom line. Cybersecurity tools, software and services can be expensive, and it’s time consuming to determine which tools you need. You need to weed through more than 3,500 vendors offering solutions and the process of finding the right vendors and onboarding them can take years. Fast-moving startups and SMEs neither have the expertise, time or the money. […]
Employees are a major attack vector for threat actors targeting organizations. Recent research by Stanford University confirms this, revealing that 88% of all data breaches are caused by human error. These human errors might be as simple as sending an email to an incorrect address or leaving a database publicly viewable; but they can also be more involved, as when employees become victims of targeted phishing campaigns. Let’s detail how employees might be increasing risk for organizations and what organizations […]
By subscribing you agree to our Privacy Policy and provide consent to receive updates from our company.
