British hacker 'behind M&S and Co-op cyber attacks' faces 22 years in jail after admitting hacking into US companies to steal at least £5.9million
A British hacker accused of being part of a group behind the cyberattacks on M&S and Co-op last year is facing 22 years in prison after pleading guilty to plotting to hack into the computer systems of at least a dozen companies in the US.
Tyler Buchanan, 24, of Dundee, has admitted to attempting to steal at least £5.9million in virtual currency from victims in the United States.
The US Department of Justice (DOJ) said he was involved in a group that used text message phishing attacks to trick employees into disclosing their login credentials, enabling access to computer systems.
Buchanan pleaded guilty to one count of conspiracy to commit wire fraud and one count of aggravated identity theft.
US officials said he and his co-conspirators sent hundreds of messages to company employees, posing as the companies or their contracted suppliers.
In his plea agreement, he admitted that between September 2021 and April 2023, the group planned to scam telecommunications companies, IT suppliers, cloud communications providers, virtual currency firms and individuals.
A device seized at Buchanan's home in Scotland showed he possessed the names and addresses of multiple victims, as well as a text file containing cryptocurrency seed phrases and login credentials for one victim's account.
'The conspirators created a phishing kit that captured login credentials entered into the fraudulent phishing websites by a victim company's employees,' the DOJ said in a statement.
Tyler Buchanan, 24, of Dundee, has admitted to attempting to steal at least £5.9million in virtual currency from victims in the United States
Buchanan was arrested in Spain last year while on his way to Italy
'The stolen credentials were then transmitted to an online Telegram channel administered by Buchanan and another co-conspirator.'
Buchanan has been in US federal custody since April 2025.
He is scheduled to be sentenced on August 21 and faces a maximum sentence of 22 years in prison.
Buchanan has been linked to notorious hacker group Scattered Spider, which is believed to bear responsibility for attacks that crippled British supermarkets M&S and Co-op in the spring and summer of 2025.
Scattered Spider is thought to be made up of 1,000 mainly British and American youths and young men, and has gained global fame for a slew of attacks on major brands.
Once they have gained access to a firm's systems, they typically demand a huge ransom payment in return for restoration.
Last year's attacks on British supermarkets left shelves empty for weeks and forced M&S to stop accepting all online orders and payments.
The National Crime Agency named Scattered Spider as being a key avenue of investigation in May.
Buchanan - pictured as a child - has been linked to notorious hacker group Scattered Spider
Scattered Spider is thought to be made up of 1,000 mainly British and American youths and young men, and has gained global fame for a slew of attacks on major brands
Co-conspirator Noah Michael Urban pleaded guilty in April 2025 to three fraud-related charges and is serving a 10-year prison sentence
Scotsman Buchanan is also alleged to have been behind the 2023 hack of Las Vegas casino operators Caesar's Entertainment and MGM Resorts International.
US prosecutors claimed he was part of a sophisticated £9million cryptocurrency fraud, which saw victims being sent phishing text messages warning their accounts would be closed.
The link directed them to a legitimate-looking website where they then entered their personal details. It's alleged the hacking gang then seized these details and used them to pilfer £9 million worth of virtual currency.
Buchanan was arrested in Spain last year while on his way to Italy.
Three other defendants, all from the United States, are still facing criminal charges, according to the DOJ.
Another co-conspirator, Noah Michael Urban, pleaded guilty in April 2025 to three fraud-related charges and is serving a 10-year prison sentence.
Urban was also ordered to pay £5.9million in restitution.
The DOJ said Police Scotland was one of several agencies providing the FBI with assistance as they carried out the investigation.
