Florida man gets 10 years in prison in first Scattered Spider sentencing
A 20-year-old Florida man received a 10-year federal prison sentence Wednesday for his role in the notorious Scattered Spider cybercrime organization, marking the first conviction of a member from the group responsible for breaching more than 130 major companies.
Noah Michael Urban, 20, of Palm Coast, Fla., pleaded guilty to conspiracy, wire fraud and aggravated identity theft charges in two separate federal cases spanning Florida and California. A federal judge sentenced Urban to 120 months in prison with three years of supervised release and ordered him to pay $13 million in restitution to victims.
The sentence exceeded federal prosecutors’ recommendation of eight years, reflecting the scope of Urban’s criminal activities that investigators say caused between $9.5 million and $25 million in total losses.
Urban operated under multiple online aliases including “King Bob,” “Sosa,” and “Gustavo Fring” while participating in sophisticated cybercrime schemes from 2021 to 2023. In the Florida case, prosecutors said Urban and co-conspirators used SIM swapping techniques to steal at least $800,000 in cryptocurrency from five victims between August 2022 and March 2023.
SIM swapping involves convincing telecom providers to transfer a victim’s phone number to a device controlled by criminals, allowing them to bypass two-factor authentication and reset passwords for financial accounts.
The California charges stemmed from a broader conspiracy involving four other defendants who conducted phishing attacks against company employees from September 2021 to April 2023. The group sent text messages claiming employee accounts would be deactivated, directing targets to fraudulent websites designed to steal login credentials.
Urban’s case provides insight into the operations of Scattered Spider, a cybercrime group that security researchers also track under names including 0ktapus and UNC3944. The organization has been linked to high-profile breaches at companies including Twilio, LastPass, DoorDash, Mailchimp, Caesars Entertainment, and MGM Resorts.
Urban was a core member of the group and a prominent figure in “The Com,” an online forum where hackers share social engineering techniques. Federal investigators believe Scattered Spider evolved from this broader community of young, English-speaking cybercriminals.
The sentencing comes as Scattered Spider has resumed activity following a brief lull after the MGM attack. The group launched new attacks in 2025 targeting airlines, insurance companies, and retailers, according to security firms and government agencies.
Four other defendants in the California case remain at various stages of prosecution, with one British national arrested in Spain and others still at large.
