Scattered Spider affiliate given 10 year sentence, ordered to pay $13 million in restitution

A federal judge sentenced a member of the Scattered Spider cybercriminal group to 10 years in prison on Wednesday. 

Noah Michael Urban, 20, pleaded guilty in April to multiple charges related to the theft of cryptocurrency and sensitive corporate documents. 

First reported by WJXT reporters in the courtroom on Wednesday, the judge ignored prosecutors’ request for an eight-year sentence and gave Urban 10 years in prison with three years of supervised release, and ordered him to pay $13 million in restitution to more than 30 victims. 

Urban was arrested last year after federal prosecutors accused him of being a key member of Scattered Spider — a now notorious cybercriminal operation best known for tricking IT help desks and using SIM swapping to bypass two-factor authentication for victim accounts. 

According to his plea agreement, he and his team used stolen IDs from August 2022 through March 2023 and conducted “phishing attacks by sending SMS phishing messages to the mobile telephones of victim company employees, using credentials stolen through SMS phishing to access the accounts of victim company employees and the computer systems of victim companies to steal confidential information and cryptocurrency."

Investigators seized a total of $2.89 million worth of cryptocurrency from Urban’s desktop computer during raids on his home in March 2023. Urban is forfeiting all of the cryptocurrency seized during the raids.

When interviewed by the FBI, Urban admitted that all of the cryptocurrency found on his computer was the result of his work with Scattered Spider. Urban noted that the group stole more than $2.6 million of cryptocurrency from at least 16 people.

U.S. prosecutors said the amount of losses caused by his actions amount to between $9.5 million and $25 million. 

Three of the charges he pleaded guilty to were filed by federal prosecutors in Florida and one more charge was transferred from federal courts in California.

The charges against Urban and the four other men were unsealed in November and a Justice Department spokesperson confirmed at the time that the five are part of Scattered Spider — responsible for several devastating cyber incidents including the ransomware attack on MGM Casino in 2023. 

One U.K. national was arrested in Palma de Mallorca in June 2024 and is facing multiple charges in the U.S., while the whereabouts of the two other Americans are unconfirmed.

The FBI believes Scattered Spider is an offshoot of a larger pool of young, English-speaking cybercriminals who dubbed themselves "the Community," or "the Com.” Several other alleged Scattered Spider members have been arrested internationally. British officials recently warned about broader activity by Com members.

After a brief lull in activity following the attack on MGM Casino, members of the group launched an assault in 2025 on multiple industries — shutting down several airlines, major insurance companies and high-profile retailers from March to July.