Tyler Robert Buchanan, a 24-year-old from Dundee, Scotland, pleaded guilty in the United States on April 17, 2026, to conspiracy to commit wire fraud and aggravated identity theft. The U.S. Department of Justice says the conspiracy used SMS phishing and SIM swapping to target company systems and steal at least $8 million in virtual-currency assets from individuals. The connection to Scattered Spider—and the claim that the attacks created the group’s notoriety—comes from reporting, not from the DOJ plea announcement.
What Buchanan pleaded guilty to
In its April 17, 2026 announcement, the U.S. Department of Justice said Buchanan pleaded guilty to one count of conspiracy to commit wire fraud and one count of aggravated identity theft. The plea agreement describes a conspiracy that ran from September 2021 through April 2023. DOJ said Buchanan had been in federal custody since April 2025.
The two counts address different conduct: the conspiracy count concerns the scheme carried out with others, while aggravated identity theft is a separate offense. The DOJ announcement says Buchanan faced a statutory maximum of 22 years in federal prison; that is a maximum, not a statement of the sentence imposed. Read the DOJ announcement and plea details.
How the attacks worked, according to DOJ
SMS phishing collected credentials
DOJ says the conspirators sent hundreds of text messages impersonating a victim company or one of its contracted IT or business-process-outsourcing suppliers. The messages linked to lookalike websites designed to collect personal information and account credentials. The conspirators then used stolen credentials to access employee accounts and company systems and steal confidential company information.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →#1 Best Overall
SIM swaps helped take over individual accounts
DOJ also says Buchanan and his co-conspirators used unauthorized account access and SIM swaps to take control of individuals’ virtual-currency accounts and bypass two-factor authentication. In a SIM swap, a fraudster persuades a mobile carrier to transfer a phone number from its subscriber’s SIM to a SIM the fraudster controls. That can redirect calls or text-message authentication codes to the new SIM.
The two techniques served distinct roles in the account described by DOJ: SMS phishing was the lure used to solicit information, while SIM swapping involved taking control of a phone number to intercept authentication messages. The announcement does not establish that any single security product would have prevented the attacks.
What the reported scale means
DOJ says the scheme affected at least a dozen companies and stole at least $8 million in virtual-currency assets from individual victims in the United States. These are figures reported by DOJ in 2026, not independently calculated totals. The company intrusions and the theft from individual account holders are both part of the alleged scheme described in the plea materials.
How strong is the Scattered Spider connection?
CyberScoop’s April 21, 2026 report describes Buchanan as a core leader of the Hacker Com subset of The Com and connects that group to the attacks. Its headline characterizes the spree as having created Scattered Spider’s notoriety. That framing is a reported characterization, not a finding stated in the DOJ plea announcement.
Rank #3
The DOJ announcement identifies the offenses and describes the scheme, but it does not identify Buchanan as a Scattered Spider member or say that his conduct created the group’s notoriety. Readers should therefore treat the group attribution and the claim about notoriety as reporting, rather than as a conclusion established by the guilty plea. Read CyberScoop’s report.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Sentencing status
The DOJ announcement scheduled sentencing for August 21, 2026. That date has passed, and the announcement alone does not establish whether the hearing took place or what sentence, if any, was imposed. A current court docket or later official release is needed to confirm the outcome.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
