Peter Stokes, 19, has been arrested in Finland and extradited to the US after the FBI linked him to the notorious Scattered Spider hacking group.
Stokes, a dual National of the US and Estonia, was held in Finland in April following an Interpol Red Notice. He appeared in federal court in Chicago Thursday and was ordered to remain in custody pending further proceedings.
U.S. officials say Stokes faces charges of computer intrusion, conspiracy and fraud after “years of work” by Interpol and the FBI. He is accused of participating in a series of cyber‑attacks that have pulled in more than $100 million in ransom payments from victims worldwide.
The Scattered Spider gang is also believed to have carried out a 2024 cyber‑attack on Transport for London that stole data belonging to roughly 10 million people, according to the UK National Crime Agency. Two young men have already pleaded guilty for their role in that incident.
According to the U.S. Department of Justice, Stokes and his co‑conspirators demanded an $8 million ransom in cryptocurrency from a luxury jewellery retailer after compromising its data last year. Although the firm refused to pay, investigators estimate it suffered at least $2 million in losses from business disruption, investigations and remediation.
The FBI teamed up with Finland’s National Bureau of Investigation and the United States Office of Justice in Copenhagen and Chicago to dismantle the operation. Investigation efforts also helped identify the group’s involvement in attacks on other British retailers such as Co‑op and M&S.
Sources say Scattered Spider’s members are predominantly young, native English‑speaking hackers from the UK and US. The group’s members have built a reputation for sophisticated ransomware schemes that target high‑profile global brands.
For more on the Transport for London hack, see Teens who hacked TfL were known to police years before the cyber‑attack.
