Two years, 117 identified children: the only Com case this week with an outcome attached

A court in the UK has sentenced Justin Swaddle, a member of the decentralised online cybercrime collective known as The Com, to two years in prison following an investigation by the National Crime Agency ^[1]. It is the only item on this week's record anchored in a verifiable outcome rather than a forecast, which makes its numbers worth reading closely: the prosecution identified 117 female victims worldwide, aged thirteen to seventeen ^[4].

Swaddle pleaded guilty to multiple charges of blackmail and child abuse, and operated under the aliases 'Epstein', 'Rugen' and 'Moscow' across Discord, Snapchat and Telegram ^[2][3]. He coerced victims into performing severe acts of self-harm and generating explicit material, and when they resisted he used video recordings, home addresses and school details to force compliance ^[5][6]. According to investigators, the motive was not money but the status and notoriety of sharing the material inside exclusive subgroups ^[7]. Alongside the custodial term, the court placed him on the National Sex Offenders Register and imposed a ten-year Sexual Harm Prevention Order ^[8].

The case did not come cheap in effort. The NCA opened its investigation in January 2024 after Swaddle's initial arrest by West Yorkshire Police, and British officers worked with agencies in the United States, Australia, Canada, Norway and New Zealand to identify and safeguard children ^[9][10]. That is six jurisdictions in total, including the UK ^[11]. Set the sentence against the victim count and you get roughly 6.2 days of custody per identified victim ^[12]. That figure is not a criticism of the investigators, who ran a multi-year international identification exercise; it is a description of what the deterrence signal looks like from inside a subgroup where the currency is notoriety, not profit.

Authorities describe The Com as a loose-knit global network subdivided into specialised factions covering physical violence, sexual coercion, financial extortion and high-profile corporate ransomware ^[13]. Enforcement pressure is clearly landing on the sexual coercion faction, where the victim evidence is concrete and the offence is unambiguous. It is not visibly landing on the ransomware faction, and nothing in this week's record suggests the same investigative model transfers.

Compare the other two items. US, UK and South Korean agencies issued a joint advisory on Gunra ransomware, a double-extortion operation first seen in April 2025 that uses malware derived from leaked Conti source code and exploits CVE-2024-55591 and CVE-2025-24472 in FortiOS and FortiProxy for initial access ^[14][15][16]. In January 2026 the group launched a Ransomware-as-a-Service affiliate programme branded 'Golden Community', recruiting penetration testers as initial access brokers ^[17]. Separately, a researcher using the handle 'Nightmare Eclipse' published a Microsoft Defender zero-day exploit called ShieldBreak, a patch bypass for RoguePlanet, a privilege escalation flaw fixed in July ^[18][19]. Both are advisories about what may happen next. Neither is a result.

What to watch: whether any of the five partner countries bring their own charges, which would tell you the cross-border safeguarding work also produced prosecutable evidence abroad. Watch whether the Sexual Harm Prevention Order constrains someone whose offending ran through consumer chat platforms ^[8]. And watch the Fortinet pair ^[16] on your own edge, because the advisory-side items still require patching regardless of whose faction is being sentenced.