Loading story…
Former AT&T retail employee Kenneth Carter of Portland, Oregon, received a 16-month federal prison sentence for using authorized store-system access to conduct SIM swaps for cybercriminals between May 2018 and November 2019. Carter transferred victims' phone numbers to SIM cards controlled by himself or co-conspirators, allowing them to reset account passwords and intercept SMS-based multifactor authentication codes tied to online banking accounts.
The conspiracy attempted to steal $593,963.77 from three victims. Fraud controls stopped two attempted bank transfers of roughly $247,000 each, but a third victim lost $99,528.33; a 2019 search of Carter's home also recovered victims' sensitive data, including Social Security numbers. The case illustrates the risk of insider-enabled SIM swapping and reliance on SMS-based authentication for high-value financial accounts.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
Carter was indicted in 2023, four years after authorities searched his home, for his role in the SIM-swapping conspiracy.
Authorities searched Carter's home in November 2019 and found sensitive information belonging to victims, including Social Security numbers.
In December 2018, Carter hijacked the phone number of a Portland victim identified as S.Q.T. The conspirators drained $99,528.33 from the victim's account following the SIM swap.
In November 2018, a SIM swap at an AT&T store in Lancaster, California, preceded an attempted transfer of $246,782.70. Bank fraud controls blocked the transfer.
In May 2018, Kenneth Carter used his AT&T store access in Portland to transfer a victim's number to an Alcatel handset. The conspirators then attempted to transfer $247,652.74 from the victim's bank account, but fraud controls blocked it.
Former AT&T retail employee Kenneth Carter was sentenced to 16 months in federal prison for using authorized store-system access to hijack customers' telephone numbers for cybercriminals. The SIM swaps enabled interception of authentication codes and access to victims' bank accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
bitdefender.com
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Tyler Robert Buchanan, a 24-year-old British national from Dundee, Scotland, pleaded guilty in U.S. federal court in California to **conspiracy to commit wire fraud** and **aggravated identity theft** for his role in Scattered Spider’s large-scale social-engineering operation. Prosecutors said Buchanan and co-conspirators ran SMS phishing campaigns from September 2021 to April 2023 that impersonated corporate IT help desks and labor providers, used fake login pages and stolen credentials, and carried out SIM swapping to breach companies and individuals. The Justice Department said the scheme stole at least **$8 million in virtual currency** from U.S. victims across telecommunications, technology, cloud communications, outsourcing, gaming, and cryptocurrency sectors. Investigators tied Buchanan to the 2022 **0ktapus** campaign, which used fake Okta login pages to compromise more than 130 organizations, including **Twilio** and **Cloudflare**, and enabled downstream attacks affecting other major brands. Authorities said stolen credentials were funneled into a Telegram channel administered by Buchanan and an associate, and searches of his residence in Scotland uncovered victim company files, personal data, and roughly 20 devices. Buchanan was arrested in Palma de Mallorca by Spanish authorities, extradited to the United States, and has been in federal custody since April 2025; he now faces up to 22 years in prison, underscoring continued law-enforcement pressure on the loosely organized Scattered Spider group, an offshoot of **The Com**.
Jun 29, 2026
Albert Gonzalez, known online as **`SoupNazi`**, was sentenced to 20 years in prison for leading a hacking ring behind some of the largest payment card breaches prosecuted in the United States. U.S. authorities said Gonzalez and his co-conspirators infiltrated major retailers and payment processors including **TJX, BJ’s Wholesale Club, OfficeMax, Barnes & Noble, Sports Authority, Dave & Buster’s, 7-Eleven, Hannaford Brothers,** and **Heartland Payment Systems**, stealing tens of millions of credit and debit card numbers and causing losses estimated at nearly **$200 million**, with broader economic damage potentially reaching into the billions. Court records said the group used **wardriving** to find vulnerable wireless networks, deployed sniffers and Trojan malware to capture payment card data, and moved stolen information through anonymous online currencies and bank accounts in Eastern Europe. The Justice Department described the operation as the largest hacking and identity theft ring then prosecuted by the U.S. government, involving accomplices in the United States, Estonia, Ukraine, and Turkey, affecting more than **250 financial institutions**, and resulting in multiple guilty pleas, extraditions, and related convictions tied to the sale and fraudulent use of more than **40 million** stolen card numbers.
Jul 22, 2026
Ivory Joe Pruitt was sentenced in federal court for his role in a multi-state wire fraud conspiracy that targeted victims at hospitals and university buildings across the United States. Prosecutors said Pruitt and his co-conspirators stole wallets, payment cards, and personal identifying information between August 2022 and May 2024, then used the stolen identities to open fraudulent **Sam’s Club** accounts and make unauthorized purchases. The scheme affected more than 30 victims in at least a dozen states and involved more than **$179,000** in attempted or completed fraudulent transactions. Pruitt received a **63-month prison sentence** and was ordered to pay **$137,392.74** in restitution. Authorities described him as a central participant in the operation, while several co-conspirators had already been sentenced in related cases. The investigation was led by the **FBI**, the **University of Kentucky Police Department**, and numerous law enforcement agencies nationwide.
Aug 6, 2026