Ricky Handschumacher’s mother did not know her son was a hacker until the police came looking for him. She had worked as a nurse inside a Florida jail, where officers began asking her about cryptocurrency. Handschumacher told her not to mention that he owned any. The truth, he later admitted, was that he had been stealing it.
In 2019, aged 25, Handschumacher was charged with conspiracy to commit wire fraud and aggravated identity theft for his role in a $2m cryptocurrency theft carried out by a group of young men known as the Community, or the Com. He pleaded guilty and served 27 months in prison. He now runs a cybersecurity consultancy that he co-founded with another former hacker.
His path into cybercrime began with online gaming. After other players repeatedly knocked him offline while he played Halo, he began using hacking techniques to retaliate. “I originally used [hacking] to protect myself,” he told the Observer UK. “If they did it to me, I could do it back. But then it turned into me abusing it and cheating and becoming one of them.”
Handschumacher progressed from gaming-related attacks to stealing gaming and Instagram accounts, then phone numbers linked to cryptocurrency holdings. The technique, known as SIM-swapping, involves manipulating access to a victim’s phone number to help take control of accounts. A contact in Miami laundered the proceeds and sent him rolls of cash through the post. Online, Handschumacher boasted about his exploits to other members of the Com.
“The fraud kids, the SIM swappers, they flex. They love to flex. That’s the downfall, typically,” he said. “The kids that are flexing… that’s how they get caught.”
The network has since grown into a global ecosystem of loosely connected online groups, operating largely through messaging services such as Telegram and Discord and gaming platforms including Roblox and Minecraft. The FBI says the Com has expanded to include thousands of people, most of them English-speaking males aged between 11 and 25. Groups associated with it have been linked to attacks on major businesses and public services, as well as increasingly serious cases of online exploitation and child abuse.
Recent victims include Marks & Spencer, Co-op, Transport for London, Salesforce and Inditex, the owner of Zara. Last week, a group calling itself ShinyHunters claimed to have breached H&M. Cybercrime costs UK businesses an estimated £14.7bn annually, according to KPMG. The attacks on M&S and Co-op, attributed to a Com-linked group called Scattered Spider, accounted for losses of up to £440m.
Four people aged between 17 and 20 have been arrested and released on bail in connection with the attacks on M&S and Co-op, which also affected Harrods. In July, two people aged 18 and 20 were jailed over an attack on Transport for London. Meanwhile, a cyberattack in France last week disrupted supermarket refrigerators and freezers, although no hackers had claimed responsibility at the time of the report.
Zach Edwards, a staff threat researcher at Infoblox, estimates that between 10% and 30% of Com members, including some of its most serious offenders, have been based in the UK. “There’s pretty strong indications the UK has a really serious homegrown problem,” he said.
The age profile of offenders presents a particular challenge for law enforcement. Research by the National Crime Agency in 2017 found that the average age of arrest for drug crime in the UK was 37, compared with 17 for cybercrime. In the past three years, 600 cases have been referred to the agency’s Cyber Choices scheme, which aims to redirect people away from criminal hacking. Officers say most of those involved are neurodiverse.
A study by Julia Davidson of the University of East London, surveying 8,000 people aged 16 to 19 across nine countries, found that 69% had participated in at least one form of cybercrime or online risk-taking. The findings suggest that risky online behaviour extends well beyond the small number of offenders responsible for major corporate attacks.
Researchers monitoring the Com’s communication channels encounter a constant stream of racist abuse, extreme sexism and memes as they search for evidence that might identify suspects. A Sky News investigation into 764, one of the network’s most abusive branches, found evidence of members grooming children through Roblox, Minecraft and Discord before blackmailing them into self-harm and sexual abuse.
Roblox declined to comment, while Mojang Studios, which owns Minecraft, did not respond to a request for comment. An Ofcom spokesperson said the threats posed by Com groups were a particular concern and that the regulator was working with law enforcement and child protection agencies. It had set clear expectations for technology companies and regularly challenged platforms over their responses to grooming, child sexual exploitation and abuse, and material relating to suicide and self-harm.
Unlike politically motivated hacktivists or state-backed cybercriminal groups, the Com appears to lack a common ideological purpose. “There isn’t really an ideology… nothing political. It is about money and kudos, really,” said Aiden Sinnott, a cybersecurity researcher at Sophos.
The demands made by some members can be strikingly immature. In August, a hacker using the name Cyberleek claimed to have obtained a copy of the forthcoming video game Grand Theft Auto VI. Among the requests reportedly directed at its developer, Rockstar, was that it resume issuing physical discs and apologise for discontinuing them.
Yet the methods are becoming more sophisticated. Over the past six to 12 months, researchers say, some young hackers have moved from selling stolen corporate data on forums to operating their own leak websites with countdown timers, imitating tactics used by Russian criminal groups. Their behaviour often remains disorganised, however, driven by the attention and approval of their peers rather than a coherent long-term strategy.
“If you’re getting kudos and accolades and admiration from your peers online that you might not be getting in the real world, maybe that’s a difficult thing to leave behind,” Sinnott said.
The consequences can extend far beyond financial losses. In late September, a hacker using the alias Rey was detained in Jordan. Saif al-Din Khader, believed to be 17, was alleged to be a senior member of ShinyHunters, which claimed both the H&M breach and the theft of FBI employee data. Samples reviewed by Reuters appeared to contain staff members’ personal details, sensitive job information and medical data.
“When you hit the FBI, you go from 15 agents on your case to 150. Smart threat actors don’t poke the bear,” Edwards said.
Other alleged participants have also been identified, including a 24-year-old man from Amsterdam and a Canadian cybersecurity company chief executive in his fifties who appears to have turned to criminal activity. The range of people associated with the network complicates efforts to define its membership and structure.
“Law enforcement feel like they’re chasing smoke,” said Fergus Hay, chief executive of the Hacking Games, an organisation focused on cyber resilience and rehabilitating hackers. “It’s a Gen Z cultural apparition… It’s not like you apply to be the Com. You just suddenly get called it.”
Hay has also warned that hostile states are beginning to exploit young members of the network. He cited the case of two 17-year-olds in the Netherlands who were arrested last year after allegedly being recruited to monitor Wi-Fi networks near Europol’s headquarters.
For parents, the growing reach of online gaming and messaging platforms makes it harder to recognise when ordinary digital activity has become dangerous. Handschumacher advises them to take an active interest in their children’s online lives rather than assuming that gaming is harmless or that criminal behaviour would be obvious.
“Hop on the game with your kid,” he said. “They’re not going to have $100,000 items in their inventory and they don’t have a job. It’s right in front of your face, but you have to know what you’re looking for.”
