26.09.2025
2 min
552
A family court has released a 17-year-old suspect in the high-profile 2023 Las Vegas casino hacking spree to his parents’ custody, despite prosecutors’ demands to keep him in custody. The teenager is linked to the Scattered Spider group that hacked MGM Resorts and Caesars Entertainment, where the attackers deployed ALPHV/BlackCat and caused more than $100 million in losses to MGM and $15 million in ransoms from Caesars.
Las Vegas police have called the incidents “sophisticated network intrusions” that occurred between August and October 2023. Prosecutors say the suspect may be holding about $1.8 million in unclaimed Bitcoin, and have pushed for his detention until a November hearing because of his “high level of operational skill” and “significant financial gain.”
The defense called the request unreasonable, noting the lack of a criminal record and the voluntary appearance. Judge Dee Smart Butler agreed to supervised release with strict restrictions: living with parents at a registered address; prohibition on leaving Clark County, Nevada; Internet access only for educational purposes; restrictions on phone and electronic use; immediate detention if the conditions are violated.
The initial charges include: obtaining personal information for harm/impersonation, extortion, conspiracy to extort, and illegal acts with computers. Prosecutors are also preparing additional charges and are requesting that they be tried as an adult, which would carry a stiffer sentence.
During the attacks, the Scattered Spider group hacked large corporate networks and deployed ALPHV/BlackCat, which led to operational disruptions and leaks of sensitive employee and customer data. Last year, another 17-year-old was detained in the same cluster case and released on bail pending investigation. The story highlights the trend of involving minors in high-profit cyber extortion and the difficult decisions of the courts between the risks of escape/recidivism and the principle of presumption of innocence.
The decision on supervisory freedom with strict restrictions shifts the focus to controlling behavior before the court and reduces the risks of escalation, but at the same time intensifies the discussion about the administrative liability of minors in serious cyber cases. For businesses, the case is another reminder of the need for strict access control, network segmentation, training against social engineering and IR plans; for law enforcement, the importance of tracing crypto assets and cooperation with exchanges.
