Suspected Scattered Spider Member Peter Stokes Extradited to the US
Published
Key Takeaways
- Suspect Arrested: A dual U.S.-Estonian citizen was extradited to the U.S. following his arrest in Finland.
- Charges Filed: He faces conspiracy, cyber intrusion, and fraud charges in the Northern District of Illinois.
- Group Impact: Scattered Spider is tied to 100+ intrusions and more than $100 million in ransom payments.
An alleged member of the criminal cyber hacking group Scattered Spider, also known as Octo Tempest, UNC3944, and 0ktapus, has been extradited to the United States to face federal charges in the Northern District of Illinois following his April arrest in Finland. A criminal complaint unsealed in U.S. District Court in Chicago charges Peter Stokes, 19, a dual citizen of the U.S. and Estonia, with conspiracy, cyber intrusion, and fraud offenses.
Scattered Spider Suspect Extradited to Chicago
Finnish authorities arrested Stokes in April pursuant to an Interpol Red Notice, and he was extradited last week. He made an initial appearance on Tuesday and was ordered detained in law enforcement custody, according to court documents.
The teen was charged in Chicago in April. The charges alleged Stokes, who used the aliases “Bouquet” and “Jordan,” personally participated in at least four Scattered Spider hacks, local press said.
The complaint describes a May 2025 intrusion against an unnamed luxury jewelry retailer. Stokes and likely co-conspirators are suspected of breaching the retailer's system, exfiltrating data, and demanding roughly $8 million in cryptocurrency. No ransom was paid, but the retailer incurred at least $2 million in losses due to business disruption, investigation, and mitigation.
Operation Riptide Targets Cybercrime
Scattered Spider has been involved in more than 100 network intrusions, resulting in over $100 million in ransom payments and millions more in damages, according to Assistant Attorney General Duva. The action is part of Operation Riptide, an ongoing FBI campaign targeting cybercrime infrastructure and financial networks.
The group gains access to corporate employee accounts through fraudulent pretenses, encrypts or exfiltrates data, and extorts cryptocurrency from victims.
In November 2025, Scattered Spider, ShinyHunters, and LAPSUS$ members announced the formation of Scattered LAPSUS$ Hunters, a new extortion-as-a-service alliance. Cartier and Dior both announced data breaches in May 2025.
In 2025, U.K. national Thalha Jubair, 19, also known by aliases such as "EarthtoStar" and "@autistic," was charged in connection with Scattered Spider attacks, and Noah Michael Urban, a key member of the group, was sentenced to 120 months in prison.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular