Project Compass: Europol Takes Down The Com — The Teen Cybercrime Network Behind MGM, M&S and Scattered Spider Attacks

Europol just dropped the hammer on The Com , a decentralized cybercrime collective made up mostly of teenagers and young adults who have been behind some of the biggest breaches of 2023-2025. Operation Project Compass has resulted in 30 arrests and 179 suspects identified across 28 countries. This isn't a story about sophisticated zero-days. It's about social engineering at scale — and why your help desk is your weakest link. What Is The Com? The Com is not a single gang — it's a loose ecosystem of young cybercriminals who recruit and radicalize each other across Discord, Telegram, gaming platforms, and social media. Members range from teenagers to young adults, primarily based in English-speaking countries. What makes The Com dangerous is its connections. Members have operated under or alongside some of the most notorious cybercrime brands: Scattered Spider (UNC3944/Octo Tempest) — help-desk social engineering specialists LAPSUS$ (DEV-0537) — insider recruitment and source code theft