UK Court Jails Alleged Scattered Spider Leader Tied to MGM, Caesars Hacks

A British hacker linked to 2023 cyberattacks on MGM Resorts and Caesars also faces US charges over 47 targeted organizations.

This post is AI-assisted writing. Mistakes can happen. If you spot an error, please let us know .

A British court has sentenced a 20-year-old man described by American prosecutors as a central figure in the Scattered Spider hacking network, the group tied to the costly 2023 cyberattacks on MGM Resorts and Caesars Entertainment. According to Casino.org, Thalha Jubair was jailed in London on Thursday, though the sentence handed down there covers a separate cybercrime in Britain rather than the US casino hacks directly.

Casino.org reports that Jubair and co-defendant Owen Flowers each received five years and six months for the 2024 hack of Transport for London, the agency that runs the city’s Tube and bus network. That attack knocked out TfL’s online services for months and exposed personal data belonging to millions of riders.

Separately, Jubair is wanted in the United States on federal charges out of New Jersey, including computer fraud, wire fraud and money laundering, connected to hacks affecting 47 American organizations. MGM Resorts and Caesars Entertainment are among the entities named in that broader case, per Casino.org. No public extradition request has been announced, though US prosecutors could pursue his transfer while he serves out his British sentence or after his release.

The Scattered Spider campaign against MGM Resorts began on September 10, 2023, and disrupted casino operations for several days. Casino.org notes MGM’s refusal to pay a ransom is estimated to have cost the company around $100 million in damages.

Caesars was hit a month earlier in an attack that wasn’t publicly disclosed until later. According to sources cited by The Wall Street Journal at the time, Caesars ultimately paid roughly $15 million of an original $30 million ransom demand after attackers stole customer data.

Casino.org points out that “Scattered Spider” is a label coined by cybersecurity researchers rather than a name the hackers used themselves; those behind the MGM and Caesars intrusions reportedly called their crew “Star Fraud,” part of a larger, loosely organized collective known as “the Com.”

US prosecutors allege that Jubair, while still a teenager, controlled servers used by the hacking group, received shares of ransom payments through cryptocurrency wallets he managed, and helped launder millions of dollars. Casino.org reports one instance allegedly involved a $25 million crypto payment from a single company, with more than $115 million in total ransomware proceeds linked to Jubair and his associates.

Prosecutors also claim Jubair kept committing cybercrimes after his arrest, including allegedly hacking into the online accounts of a US federal magistrate judge overseeing proceedings against an alleged co-conspirator, apparently to gather intelligence on that case.

In court, Casino.org notes, Jubair appeared far removed from the international cybercrime figure described in US filings — a slight, bespectacled young man still living with his parents in public housing in one of east London’s poorer neighborhoods, despite prosecutors’ claims that he had access to tens of millions of dollars in stolen and extorted cryptocurrency.

Related: MGM Resorts Forms Special Committee to Weigh Barry Diller’s $12.4B Buyout Bid