Key facts
- Peter Stokes, 19, has been extradited to the US from Finland.
- He is accused of involvement with the 'Scattered Spider' hacking group.
- Stokes allegedly participated in an unsuccessful $8 million cryptocurrency ransom attempt.
- The target was a luxury jewelry retailer whose systems were breached.
- The company did not pay the ransom but incurred $2 million in damages.
A teenager suspected of involvement with the 'Scattered Spider' hacking group has been extradited to the US to face charges related to an alleged $8 million cryptocurrency ransom scheme. Peter Stokes, a 19-year-old dual US-Estonian national, was arrested in Finland in April and brought to Chicago last week.
According to a criminal complaint unsealed in court, Stokes and others are accused of breaching the computer systems of a luxury jewelry retailer in May 2025. The goal was to steal data and demand a ransom payment of $8 million in cryptocurrency. Although the retailer successfully removed the hackers from its network and did not pay, it suffered approximately $2 million in damages due to disruption.
The complaint details that the hack began with phishing calls to the company's tech help desk, where Stokes and accomplices allegedly posed as employees to reset login credentials. They reportedly compromised three employee accounts, including two belonging to IT administrators, within two hours. These compromised accounts provided access to higher-privilege systems.
Authorities allege that Stokes, who uses online aliases 'Bouquet' and 'Jordan,' is a member of 'Scattered Spider' and has participated in or assisted with numerous intrusions on various companies. A search of a device allegedly linked to Stokes reportedly revealed exfiltrated records from victim companies and downloads from a server identified by Microsoft as being used for intrusions.
Stokes' Snapchat account allegedly showed evidence of 'substantial wealth' for his age, including boasts about international travel and media regarding apprehended 'Scattered Spider' members. The Justice Department stated that 'Scattered Spider,' also known by other names like 'Octo Tempest,' has been linked to over 100 network intrusions, resulting in more than $100 million in ransom payments and significant damages.
Stokes faces six charges, including hacking, cyber extortion, fraud, and conspiracy.