A 19‑year‑old, Peter Stokes, has been arrested in Finland and extradited to the United States on charges linked to the notorious Scattered Spider hacking group.
The U.S. Department of Justice said the teenager was charged with computer intrusion, conspiracy and fraud after a long investigation and an Interpol Red Notice that led to his capture in April.
Scattered Spider is believed to have generated more than $100 million in ransom payments. The group has also been blamed for the £39 million 2024 Transport for London cyber‑attack and attacks on British retailers such as Co‑op and M&S.
Stokes, a dual US‑Estonian national, appeared in federal court in Chicago on Tuesday and was ordered to remain in custody while investigators work through the case. The complaint alleges that he and other co‑conspirators demanded about $8 million in cryptocurrency from a luxury jewellery retailer after compromising its data last year; no ransom was paid, but the company lost at least $2 million in disruption and mitigation costs.
The Federal Bureau of Investigation, operating from Copenhagen and Chicago, and Finland’s National Bureau of Investigation led the operation that brought Stokes in front of U.S. authorities.
The charges come after two young men pleaded guilty last month to offences linked to the Transport for London attack. The NCA’s investigation linked the 2024 "network intrusion" that stole data on about 10 million people to the Scattered Spider group. The group’s members are thought to be young, native English speakers from the U.S. and U.K.
Two young men pleaded guilty to the offences that connect to the £39 million attack on Transport for London.
Network intrusion that stole data on 10 million people was carried out by the group, according to NCA investigators.
