Key facts
- Peter Stokes, a 19-year-old dual US-Estonian citizen, has been extradited from Finland to the U.S.
- Stokes is accused of being a member of the 'Scattered Spider' hacking group.
- He faces federal charges of conspiracy, computer intrusion, and fraud.
- Scattered Spider is linked to over 100 network intrusions and more than $100 million in ransom payments.
- Stokes was arrested in Finland in April and ordered to remain in custody after appearing in federal court in Chicago.
A 19-year-old dual US-Estonian citizen, Peter Stokes, accused of being a member of the 'Scattered Spider' hacking group, has been extradited from Finland to the United States to face federal charges. The US Department of Justice announced the extradition, stating that Stokes faces charges of conspiracy, computer intrusion, and fraud.
Stokes was arrested in Finland in April and appeared in federal court in Chicago on Tuesday, where he was ordered to remain in custody. The criminal complaint alleges that Stokes and co-conspirators targeted a luxury jewelry retailer in May 2025, exfiltrating data and demanding approximately $8 million in cryptocurrency. The retailer, however, was able to remove the threat actors from its network, though it reported at least $2 million in losses due to business disruption and mitigation efforts.
Scattered Spider, also known as 'Octo Tempest,' 'UNC3944,' or '0ktapus,' is described by the FBI as a group of criminal cyber actors linked to over 100 network intrusions, resulting in more than $100 million in ransom payments and millions in damages. In June, two men pleaded guilty in the UK for a cyberattack on Transport for London, which cost the organization £29 million in losses and recovery costs. The NCA also stated that Scattered Spider was a key part of their investigation into cyber attacks on British retailers Co-op and M&S last year.