London Teenager Orchestrated $115 Million 'Help Desk' Extortion Scheme Against 47 U.S. Companies

A 19-year-old London teenager has been charged with orchestrating a massive cyber extortion scheme that targeted 47 U.S. companies, resulting in over $115 million in ransom payments. Thalha Jubair, who used aliases including "Austin," "Brad," and "EarthtoStar" during his involvement with the malicious hacking group known as "Scattered Spider," is facing a maximum 95 years in prison for his role in the scheme.

The scheme, which allegedly began in May 2022 and continued until September 2025, involved Jubair and other unnamed conspirators contacting company help desks and convincing representatives to reset passwords multiple times. The hackers also allegedly used password cracking software to gain access to sensitive information.

Once inside the company networks, the alleged hackers would encrypt or steal data and threaten to delete or publish it unless executives agreed to pay ransom. The financial services firms allegedly each paid $25 million and $36.2 million in Bitcoin in 2023 – the highest payments listed in the complaint.

The operation was multi-faceted, with authorities claiming that Jubair and other unnamed conspirators targeted not only U.S. companies but also the U.S. federal court system. The hackers allegedly stole 18 megabytes of data, including thousands of names of Court employees, job titles, work locations, and usernames, as well as cellphone numbers.

The Department of Justice alleges that Jubair's actions caused widespread disruption to U.S. businesses and organizations, including critical infrastructure and the federal court system. Acting Assistant Attorney General Matthew R. Galeotti stated that "these malicious attacks committed by Scattered Spider resulted in over $115 million in ransom payments from victims" and highlighted the significant threat posed by brazen cybercriminals.

The U.K.'s National Crime Agency (NCA) and City of London Police arrested Jubair at his home address in East London this week. A second teenager, Owen Flowers, 18, of West Midlands in the U.K., was also arrested for their involvement in an August 2024 attack on Transport for London. Both teenagers were charged with crimes related to their involvement in the Scattered Spider scheme and are currently being held in custody.

"The arrest of Thalha Jubair underscores an undeniable truth: no matter how elusive or destructive these cyber-criminal syndicates are, we will continue to pursue those who allegedly extort our businesses and ensure they are held accountable," said FBI Special Agent in Charge Stefanie Roddy. "These charges reflect extraordinary coordination with our foreign and industry partners and mark a decisive victory against cybercriminal gangs who thought they could cripple American industries, inflict hundreds of millions in losses, and hide behind a screen without consequence."

The Scope of the Scheme

According to the Department of Justice, Jubair and other unnamed conspirators targeted at least 120 computer networks, including the U.S. federal court system. The scheme allegedly began with Jubair's involvement in the malicious hacking group known as "Scattered Spider," which could have begun when he was as young as 15 or 16.

The complaint lists 47 unnamed companies in the U.S. as victims, including airlines, manufacturers, retailers, five tech companies, three financial services firms, and dozens of others. The U.S. federal court system was also allegedly targeted in the scheme, with hackers stealing sensitive information from Court employees and networks.

The operation was complex, with hackers using multiple tactics to gain access to sensitive information and extort ransom payments from victims. The scheme resulted in over $115 million in ransom payments, with financial services firms allegedly each paying $25 million and $36.2 million in Bitcoin in 2023.