A superseding indictment is an updated criminal charging document filed in an existing case. It can add new counts, include additional defendants, correct earlier charges, or expand the allegations as prosecutors gather more evidence. The new filing replaces the earlier indictment for the parts it covers, while keeping the case active.
In cyber security cases, superseding indictments often appear when investigators identify more victims, more infrastructure, or a broader phishing and credential-theft campaign than first understood. For defenders, that can reveal the scope of an operation, the techniques used, and whether the case involves valid-account abuse, malware, or coordinated social engineering. It also matters for attribution and threat intelligence: an expanded indictment can connect separate incidents into one campaign and help security teams refine detections, monitoring, and incident response.