In brief
Peter Stokes, a 19‑year‑old dual US‑Estonian national, was detained in Finland and extradited to the United States after Interpol issued a Red Notice. He faces charges of computer intrusion, conspiracy and fraud tied to the Scattered Spider ransomware collective, which has generated over $100 million in ransom payments. The FBI and Finland’s National Bureau of Investigation worked together on the case, which follows recent convictions related to the 2024 Transport for London cyber‑attack. Stokes is alleged to have demanded $8 million in cryptocurrency from a luxury jewellery retailer, though the ransom was never paid and the company suffered $2 million in losses due to disruption. Investigators say Scattered Spider’s members are mostly young, native English‑speaking US and UK hackers.
Peter Stokes, 19, has been arrested in Finland and extradited to the US after the FBI linked him to the notorious Scattered Spider hacking group.
Stokes, a dual National of the US and Estonia, was held in Finland in April following an Interpol Red Notice. He appeared in federal court in Chicago Thursday and was ordered to remain in custody pending further proceedings.
U.S. officials say Stokes faces charges of computer intrusion, conspiracy and fraud after “years of work” by Interpol and the FBI. He is accused of participating in a series of cyber‑attacks that have pulled in more than $100 million in ransom payments from victims worldwide.
The Scattered Spider gang is also believed to have carried out a 2024 cyber‑attack on Transport for London that stole data belonging to roughly 10 million people, according to the UK National Crime Agency. Two young men have already pleaded guilty for their role in that incident.
According to the U.S. Department of Justice, Stokes and his co‑conspirators demanded an $8 million ransom in cryptocurrency from a luxury jewellery retailer after compromising its data last year. Although the firm refused to pay, investigators estimate it suffered at least $2 million in losses from business disruption, investigations and remediation.
The FBI teamed up with Finland’s National Bureau of Investigation and the United States Office of Justice in Copenhagen and Chicago to dismantle the operation. Investigation efforts also helped identify the group’s involvement in attacks on other British retailers such as Co‑op and M&S.
Sources say Scattered Spider’s members are predominantly young, native English‑speaking hackers from the UK and US. The group’s members have built a reputation for sophisticated ransomware schemes that target high‑profile global brands.
For more on the Transport for London hack, see Teens who hacked TfL were known to police years before the cyber‑attack.
