It is claimed they were part of a hacking organisation called Scattered Spider, which in September 2023 also crashed the networks at casino firms Caesars Entertainment and MGM Resorts International.
They managed to disable the groups’ operations and demanded hefty ransom payments. Caesars paid about $15m (£12m) to restore its network.
On Wednesday, Martin Estrada, US attorney in Los Angeles, outlined details of charges related to alleged phishing attacks targeting various companies.
He claimed, that from at least September 2021 to April 2023, the defendants sent text messages to victims’ mobile phones warning that their accounts would be deactivated.
According to court documents, links in the SMS messages directed staff to websites – which looked legitimate – requesting log-in information for their company or supplier.
Once the hackers stole the credentials they are accused of harvesting confidential information. In some cases, it is alleged they used the data to access cryptocurrency accounts and steal millions.
A British man is among those charged. Tyler Robert Buchanan, 22, from Scotland, is accused of conspiracy to commit wire fraud, conspiracy, wire fraud, and aggravated identity theft.
The United States Attorney’s Office for the Central District of California told Sky News that Mr Buchanan is currently in custody in Spain.
When asked about legal arrangements to potentially extradite him to the US from Spain, the office said it had “no comment” to make.
In June, Spanish police said they had arrested at Palma airport in Majorca a 22-year-old British national, who was allegedly the leader of an organised group dedicated to stealing information from companies and cryptocurrencies, and who managed to gain control of 391 bitcoins worth more than 27 million dollars.
The Spanish National Police said in a statement on its website that he was preparing to leave Spain on a charter flight bound for Naples at the time.
The remaining four people – all in their twenties and from Texas, Florida and North Carolina – are accused of similar offences.
The other four charged are: Ahmed Elbadawy, 23, of College Station, Texas; Joel Evans, 25, of Jacksonville, North Carolina; Evans Osiebo, 20, of Dallas; and Noah Urban, 20, of Palm Coast, Florida.
Victims allegedly included at least 12 companies in the gaming, outsourcing, telecommunications and cryptocurrency fields, plus hundreds of thousands of individuals.
“We allege that this group of cybercriminals perpetrated a sophisticated scheme to steal intellectual property and proprietary information worth tens of millions of dollars and steal personal information belonging to hundreds of thousands of individuals,” said US attorney Martin Estrada.
The FBI, which is investigating, says it secured help from other law enforcement agencies including Police Scotland.
If convicted, each defendant faces a statutory maximum sentence of 20 years for conspiracy to commit wire fraud, up to five years for conspiracy, and a mandatory two-year consecutive prison sentence for aggravated identity theft.
