A 19-year-old accused of running with the hacking crew Scattered Spider is now sitting in a Chicago jail cell. Peter Stokes was picked up by Finnish police in April, reportedly as he tried to board a flight to Japan. Last week, he landed on U.S. soil instead.
Stokes holds dual U.S. and Estonian citizenship. Prosecutors say that doesn't matter much now. He's charged with conspiracy, computer intrusion and fraud, according to a complaint unsealed Tuesday in the Northern District of Illinois.
Finnish authorities made the arrest off an Interpol Red Notice. From there it was a short trip to a Chicago courtroom, where Stokes appeared Tuesday and a judge ordered him held. No bail. No release date.
"We will continue to partner to ensure that cybercriminals cannot evade the reach of the United States.
— A. Tysen Duva, Assistant Attorney General, DOJ Criminal Division
Scattered Spider isn't new to federal prosecutors. The group has been tied to more than 100 network break-ins, with victims paying out over $100 million in ransoms, on top of millions more in cleanup costs.
Investigators say the crew works through social engineering, not software bugs. Fake help-desk calls. Phishing texts. Fake login pages built to steal passwords and slip past two-factor authentication.
Court filings identify Stokes by the online handles "Bouquet" and "Jordan." Investigators tie him to at least four intrusions, starting when he was just 16 years old.
The Jewelry Heist That Didn't Pay Off
One case stands out in the complaint. In May 2025, prosecutors say Stokes and his co-conspirators broke into the network of an unnamed luxury jewelry retailer, grabbed company data, then demanded roughly $8 million in cryptocurrency to hand it back.
The company said no. Security staff booted the intruders out before any ransom moved. Still, the retailer walked away with over $2 million in losses from the disruption, the investigation and the cleanup.
A Crew of Teenagers, Millions in Damage
Scattered Spider first made headlines in September 2023, when its members locked down the networks of casino giants Caesars Entertainment and MGM Resorts International and demanded steep ransoms. The group has kept going since, hitting multinational firms and individual cryptocurrency holders alike.
What the Complaint Lays Out
The FBI's affidavit paints a picture of a teenager flush with cash he couldn't easily explain, boasting online about international travel and sending friends images mocking arrested Scattered Spider members.
✓ Membership in Scattered Spider, also tracked as Octo Tempest, UNC3944 and 0ktapus
✓ Alleged role in a 2025 jewelry retailer breach and $8 million extortion attempt
✓ Arrest in Finland on an Interpol Red Notice
✓ Extradition and initial court appearance in Chicago
Allison Nixon, chief research officer at cybersecurity firm Unit 221B, told Reuters that hackers linked to Stokes had threatened her as far back as 2022. She said the justice system needs tougher penalties to deter the group.
More Arrests Likely to Follow
Stokes is hardly the first Scattered Spider suspect to face a U.S. courtroom, and he probably won't be the last.
Scottish national Tyler Buchanan pleaded guilty in April 2026 to fraud and identity theft tied to the group, admitting to stealing at least $8 million through phishing campaigns against firms including Twilio and LastPass. Florida member Noah Urban was sentenced last August to 10 years and ordered to repay roughly $13 million.
Scattered Spider has repeatedly targeted U.S. companies, extorting employees, inflicting millions of dollars in losses.— Brett Leatherman, Assistant Director, FBI Cyber Division
The Justice Department's Office of International Affairs worked with Finland's National Bureau of Investigation to secure the extradition. Prosecutors in Chicago now carry the case forward.
For a group built largely of teenagers hiding behind screen names, the walls appear to be closing in. Investigators say the evidence pulled from Stokes' devices in Helsinki could point them toward still more members of the crew.
