Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
A 22-year-old British man was arrested in Palma de Mallorca, Spain, on May 31, 2024, while reportedly trying to board a flight to Italy. SecurityWeek later identified him as Tyler Buchanan of Scotland, citing information cybersecurity journalist Brian Krebs said he obtained from sources. The reported leadership role remains an allegation: the available accounts do not establish that Buchanan was a Scattered Spider member or leader, or document the final outcome of his case.
What was reported about the Spain arrest?
SecurityWeek reported on June 17, 2024, that Spanish police had recently arrested a 22-year-old British man in Spain over a suspected leadership role in Scattered Spider. Its account, citing Spanish outlet Murcia Today, placed the arrest in Palma de Mallorca as the man tried to board a flight to Italy. A June 2024 security-intelligence update gave the date as May 31 and described the destination as Naples on a private flight. That update is not an arrest record or court filing.
SecurityWeek said the arrest followed cooperation between Spanish police and the FBI. The reporting does not, by itself, establish what evidence authorities had or what role the suspect may have played.
Was the suspect Tyler Buchanan, and was he the group’s leader?
SecurityWeek attributed the name Tyler Buchanan, from Scotland, to information Brian Krebs said he learned from sources. The Spanish report cited in SecurityWeek’s article initially left the man unnamed. On the available reporting, Buchanan’s identity should therefore be understood as a media attribution, not a name confirmed in a Spanish police announcement.
#1 Best Overall
The descriptions “suspected leader” and “ringleader” refer to an alleged role, not a court finding. The accounts available here do not establish guilt, prove membership or leadership, or document a final legal disposition. They do not establish that Buchanan was convicted, extradited, sentenced, or formally charged.
What is Scattered Spider accused of doing?
A joint advisory updated July 29, 2025, by the FBI, CISA, and international partners describes Scattered Spider as a threat group also known by names including UNC3944, Scatter Swine, Oktapus, Octo Tempest, Storm-0875, and Muddled Libra. The advisory describes group-level methods including social engineering, help-desk impersonation, SIM swapping, credential theft, attempts to bypass multifactor authentication, data extortion, and ransomware variants. These are descriptions of the group’s reported activity, not evidence that Buchanan personally used any particular method.
SecurityWeek’s 2024 coverage of the 0ktapus SMS-phishing campaign cited a figure of at least 130 organizations affected. That is a campaign-level figure as reported by SecurityWeek, not a count of organizations attacked by Buchanan.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →How is this arrest different from later Scattered Spider cases?
Several later cases involve different people and jurisdictions. Their allegations, figures, and procedural developments should not be attributed to the man arrested in Spain.
Rank #3
| Person and case | Jurisdiction and timing | What was reported |
|---|---|---|
| Tyler Buchanan (identity attributed by SecurityWeek to Krebs-sourced information) | Reported arrested in Spain on May 31, 2024 | Suspected leadership role in Scattered Spider; the reviewed accounts do not establish a final disposition. |
| Thalha Jubair and Owen Flowers | UK arrests and charges reported in September 2025; Jubair was also the subject of a separate U.S. case | The UK proceedings were tied to a TfL investigation. In the separate U.S. case, the Department of Justice alleged approximately 120 network intrusions, at least 47 U.S.-based victims, and more than $115 million in ransom payments. Those allegations and figures concern Jubair’s case, not Buchanan. |
| Peter Stokes | Arrest and U.S. prosecution reported in 2026, following a Finland arrest and extradition | The Department of Justice complaint alleged more than 100 network intrusions, over $100 million in ransom payments, and millions more in damages. These are allegations in Stokes’s separate case, not Buchanan’s. |
Charges and complaint allegations are not convictions. The U.S. Department of Justice states that defendants are presumed innocent unless and until proven guilty; the UK National Crime Agency page concerning Jubair and Flowers describes charges, not convictions.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What security steps does the 2025 advisory recommend?
The FBI, CISA, and partner agencies’ July 29, 2025 advisory recommends that organizations “Enable and enforce phishing-resistant multifactor authentication (MFA).” It also says to “Maintain offline backups of data that are stored separately from the source systems and tested regularly.” A FIDO2-compatible security key is one possible physical way to implement phishing-resistant MFA; the advisory does not make that a requirement or connect the measures to Buchanan’s arrest.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
