Scattered Spider

Scattered Spider refers to a shifting set of attackers, often very young, from the United States and the United Kingdom, emerging from online communities specialized in SIM swapping and account theft. Their strength is social rather than technical: they call a company's IT help desk posing as an employee, get a password or authentication factor reset, then work their way up to administrator accounts. In September 2023, they breached a large Las Vegas casino group this way, which put the attack's impact at about a hundred million dollars, and another, which reportedly paid a ransom. They partner with a ransomware group to encrypt systems. In spring 2025, attacks attributed to the same network hit major UK retailers, one of which estimated the impact on its profit at about 300 million pounds, then US insurers. Arrests have been made in the United States and the United Kingdom. For insurance, the group illustrates a vulnerability questionnaires measure poorly: the help desk's identity verification procedures. It led underwriters to ask insureds about access resets by phone and about monitoring of privileged accounts.