Ten Years, and Thirteen Million Dollars That Will Not Be Paid

Noah Urban was convicted in the United States in August 2025 on fraud and identity theft charges, receiving a ten-year sentence and an order to pay $13 million in restitution. Reporting describes him as the first member of the loose cluster tracked as Scattered Spider to be convicted.

Most of what this database records about attackers is assessment: researchers matching tradecraft, vendors naming clusters, officials attributing campaigns. This desk grades those as claims, at 26-0217 and 25-0512, because a resemblance is not an identification.

A criminal conviction is different in kind. Evidence was tested to a standard, before a court, with the defence able to contest it. It is the highest-confidence attribution available anywhere in this corpus, and there are only a handful of files that carry one.

"Scattered Spider" describes a fluid set of individuals rather than an organisation. Convicting a member does not convict the group, because the group is not an entity with membership.

The prosecution therefore proceeded on what the individual did — specific frauds, specific identities, specific victims — not on affiliation. That is the correct legal approach and it is also a reminder that the label is an analytical convenience the justice system does not use.

$13 million against an individual is a statement of scale, not a recovery. As at 25-0521, where a 20-year-old was ordered to pay $14 million, the order records harm and does not compensate anybody.

The corpus’s consistent finding on enforcement holds: prosecution establishes accountability and restores nothing. The Co-op members whose records were taken at 25-0501 are no better off for this sentence, and the data is still circulating.