SIM-Swapper, Scattered Spider Hacker Gets 10 Years
Summary: Noah Michael Urban, a 20-year-old from Palm Coast, Florida, was sentenced to 120 months in federal prison and ordered to pay roughly $13 million in restitution after pleading guilty to wire fraud and conspiracy charges tied to SIM-swapping attacks. Prosecutors said Urban and co-conspirators stole at least $800,000 from five victims, and his Scattered Spider group's SMS and voice phishing campaigns against fake Okta login pages gave them access to more than 130 companies, including Twilio, LastPass, DoorDash, MailChimp, and Plex.
Why it matters: The group's entry point was not a software flaw but employees entering credentials and one-time passcodes on lookalike Okta pages, and that phishing spree reached more than 130 companies; the same actor also obtained a magistrate judge's email password by calling an outside contractor and requesting a password change.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026