Alleged Scattered Spider member extradited from Finland to face U.S. charges
U.S. prosecutors have charged a 19-year-old alleged member of the Scattered Spider hacking group after his extradition from Finland, the Justice Department announced July 1.
Scattered Spider is known for social engineering: prosecutors say victims' employee accounts were accessed through fraudulent pretenses. Federal authorities say the group has been involved in more than 100 network intrusions and more than $100 million (U.S.) in ransom payments.
The allegations
According to the Justice Department, Peter Stokes, a dual citizen of the United States and Estonia, faces a criminal complaint in the Northern District of Illinois alleging conspiracy, computer intrusion and fraud. Prosecutors allege that in May 2025 Stokes and co-conspirators breached a luxury jewelry retailer, stole data and demanded about $8 million (U.S.) in cryptocurrency. The retailer removed the attackers and did not pay, but lost at least $2 million (U.S.).
Finnish authorities arrested Stokes on an Interpol Red Notice. He was extradited in June and made his first appearance in federal court in Chicago on June 30. Silicon UK reported that he was ordered held in custody and that the complaint includes Snapchat images of Stokes with cash and gold jewelry.
The FBI's Chicago field office investigated with help from its Copenhagen attaché office and Finland's National Bureau of Investigation. Assistant Attorney General A. Tysen Duva described the case as the result of years of work, Silicon UK reported. The Justice Department noted that a complaint is only an allegation and that Stokes is presumed innocent.
A widening crackdown
The case is one of several against people accused of Scattered Spider activity. In the United Kingdom, the National Crime Agency has said the group carried out the 2024 cyberattack on Transport for London; two young men pleaded guilty to that attack in June 2026 and await sentencing, Silicon UK reported. The group is also believed to be linked to the 2025 attacks on Marks & Spencer, the Co-op and Jaguar Land Rover.
Silicon UK listed ShinyHunters among the names associated with Scattered Spider, along with Octo Tempest, UNC3944 and 0ktapus, reflecting how loosely the group's membership overlaps with other extortion crews.
What to do
- Require strong identity checks before help-desk staff reset passwords or enrol new MFA devices, such as call-backs to a known number or manager approval.
- Use phishing-resistant MFA, such as security keys, for administrators and IT staff.
- Alert on new MFA registrations and sign-ins from unfamiliar devices soon after a reset.
