The U.S. Department of Justice announced it had arrested an alleged member of the criminal cyber hacking group “Scattered Spider” in Finland and had him extradited to the United States to face federal criminal conspiracy charges.
According to the criminal complaint, 19-year-old Peter Stokes, a dual citizen of the United States and Estonia, was charged with conspiracy, computer intrusion, and fraud. Stokes was arrested in April and extradited to the United States last week. His first court appearance was on Tuesday in federal court in Chicago. He was ordered to remain in custody.
“The criminal complaint charges Peter Stokes with membership in Scattered Spider, a hacking group that has been involved in over 100 network intrusions, resulting in more than $100 million in ransom payments and millions more in damages to the victims,” Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division said. “The charges unsealed today are the result of years of work by the Criminal Division, the U.S. Attorney’s Office for the Northern District of Illinois, and the FBI. We will continue to partner to ensure that cybercriminals cannot evade the reach of the United States.”
Officials said the charges stem from Stokes alleged involvement in Scattered Spider, also known as “Octo Tempest,” “UNC3944,” and “0ktapus,” a group of criminal cyber actors that has targeted American corporate victims by gaining access to companies’ employee accounts through fraudulent pretenses, encrypting corporate data and then extorting the company for cryptocurrency.
The complaint alleges that Stokes and others breached a luxury jewelry retailer’s computer system, exfiltrated data from the company, and ransomed the data for approximately $8 million in cryptocurrency in May 2025. The retailer’s security company was able to thwart the extortion measures, and no ransom was paid, but the company still suffered $2 million in damages due to business disruption, investigation, and mitigation of the threat.
“The malicious attacks from Scattered Spider caused widespread disruption to businesses and organizations throughout the United States,” U.S. Attorney Andrew S. Boutros for the Northern District of Illinois said. “As Co-Chair of the White Collar, Cyber, and Crypto Subcommittee of Acting Attorney General Blanche’s Advisory Committee, I am acutely aware of the significant and growing threat posed by brazen cyber criminals. These charges underscore our unwavering commitment to keeping pace with technologically savvy criminal actors and holding accountable those who seek to profit from cyber intrusions, including those located in foreign jurisdictions who do harm to American businesses and victims.”
This action is part of Operation Riptide, an ongoing FBI campaign targeting the actors, infrastructure and financial network behind cybercrime, cyber-enabled crime, and fraud against the American people.