A 19-year-old dual U.S.-Estonian national has been arrested in Finland and extradited to the United States on charges related to the Scattered Spider hacking group, the U.S. Department of Justice announced. Peter Stokes was taken into custody in April following an Interpol Red Notice and appeared in federal court in Chicago, where he was ordered to remain detained.
The charges include computer intrusion, conspiracy, and fraud, stemming from what the Justice Department described as "years of work." The complaint alleges that Stokes and co-conspirators attempted to extort approximately $8 million in cryptocurrency from a luxury jewelry retailer last year after stealing its data. While the company ultimately did not pay the ransom and "evicted" the hackers, it incurred at least $2 million in losses due to business disruption and threat mitigation.
Scattered Spider has been linked to cyberattacks that have resulted in over $100 million in ransom payments, according to the Justice Department. The arrest and charges against Stokes follow guilty pleas by two young men last month in connection with a significant 2024 cyberattack on Transport for London. The UK's National Crime Agency (NCA) has stated its belief that Scattered Spider was responsible for that network intrusion, which led to the theft of data from approximately 10 million individuals.
The NCA has also identified Scattered Spider as a key focus in its investigations into cyberattacks against British retailers Co-op and M&S last year. The group is believed to be composed of young, native English speakers from the U.S. and the UK.
The investigation and arrest involved collaboration between the FBI in Copenhagen and Chicago, and Finland's National Bureau of Investigation.