JACKSONVILLE, Fla. – Federal court documents released recently reveal new details about the dozens of people who are now owed restitution money by a Florida man headed to federal prison for cybercrimes.
Noah Urban of Palm Coast, now 21, was sentenced last month to a total of 10 years in federal prison. He’d previously pleaded guilty to charges including conspiracy and wire fraud in two separate federal cases: charges in Florida that were unsealed in January 2024, and charges in southern California that were announced in November of last year.
Recommended Videos
In the Florida case, Urban was accused of stealing at least $800,000 in cryptocurrency from five different victims between August 2022 and March 2023. Prosecutors said Urban and others would steal victims’ personal information and arrange for the victims’ cell phone numbers to be swapped to phones that Urban and the other conspirators controlled. They would then use that to get control of the victims’ cryptocurrency accounts by resetting passwords and confirming via text message passwords. The tactic is known as “SIM swapping.”
In November 2024, prosecutors in Los Angeles announced that Urban was one of five people charged with running a scheme that targeted companies via phishing text messages. Prosecutors said the group would obtain employee login credentials, then steal non-public company data and information. Federal authorities also said the group would use the phishing messages to get access to virtual currency accounts, stealing millions of dollars in cryptocurrency.
As part of his plea agreement, Urban agreed to pay $13 million in restitution to victims in both the Florida and California cases. While the plea agreement broke down how much each victim was owed and tied the victim to either the Florida case or the California case, it didn’t provide other details about who the victims were.
Earlier this month, Urban’s attorneys filed a notice with the federal court that they planned to appeal the judgment to the 11th Circuit of the U.S. Court of Appeals. While the plea agreement stated that Urban waived his rights to appeal his sentence, there were some exceptions that would allow him to appeal. It is not yet clear on what grounds his appeal will be based.
The initial appeal documents filed with the court also included a list of restitution victims, with names, addresses, and dollar figures. Of the 59 listed victims, 14 had addresses in California, six in New York, five in Texas, and four each in Florida and Pennsylvania. Three victims had addresses in Washington state, with the remaining victims hailing from more than a dozen other states from coast to coast.
Using a variety of records and research, News4JAX has attempted to learn who some of these victims appear to be:
-
The single-largest amount of restitution, $3,584,787, is owed to a man in California, whose records and online profiles suggest is a venture capitalist.
-
Two other victims are also owed more than $1 million each: A New Hampshire man owed more than $1.6 million, and an Alabama man owed more than $1.1 million. According to the plea agreement, both of these victims stem from the California charges tied to the phishing text message scheme.
-
Four victims are owed roughly half a million dollars: A California man who appears to be a cloud computing architect, a 74-year-old Nevada man, a man in the Houston area, and an Oregon woman whose online profiles indicate is a hypnotherapist and sound healer.
In the California case, the indictment provided details about how some of the individual victims were allegedly defrauded, including whether “SIM swapping” was involved, and connected specific defendants to some of the cryptocurrency thefts. In two of the thefts, co-conspirators circulated the victims’ names and emails, along with the words “highnetworth” and “funded.” Both of those victims appear to be dentists: a California woman owed nearly $196,000 in restitution, and a Pennsylvania man owed more than $129,000.
Based on online records corresponding to names and addresses given for the victims, more than a dozen of them are in their 40s, with nearly as many in their 60s. Three of the victims are in their 80s.
Urban, who, according to the indictment, was also known by aliases including “King Bob” (a reference to the “Minions” movie) and “Gustavo Fring” (a reference to a character from “Breaking Bad”), is believed to be a member of a group called “Scattered Spider.”
According to federal cybersecurity officials, the group targets large companies and their contracted IT help desks. Authorities warn that Scattered Spider members have:
-
Posed as company IT and/or helpdesk staff using phone calls or SMS text messages to obtain login credentials from employees
-
Posed as company IT and/or helpdesk staff to direct employees to run commercial remote access tools, giving them access
-
Posed as IT staff to convince employees to share one-time passwords used for multi-factor authentication, a common security measure
-
Monetized access to victim networks in numerous ways, including extortion enabled by ransomware and data theft.
Krebs on Security and 60 Minutes previously reported that Urban is a key figure in the crime ring, according to their sources.
Some of the money stolen from victims was then used for activities related to phishing, according to investigators. The California indictment states that some of the money taken from two victims was used to pay for an account used to register phishing domains. One of those victims, a Georgia man who lost more than $95,000, appears to be a realtor. The other victim is a California man who lost more than $400,000, and whose records suggest owns a commercial painting business.
The Bureau of Prisons currently shows that Urban is incarcerated at FCI Tallahassee, a low-security federal correctional institution. The federal judge who sentenced Urban recommended to the Bureau of Prisons that while serving his sentence, Urban should participate in mental health treatment, specifically gambling therapy.