Alleged Scattered Spider Member Extradited to U.S. to Face Cybercrime Charges
Summary
Peter Stokes, 19, was extradited from Finland to the U.S. to face fraud, conspiracy and computer-intrusion charges. Prosecutors allege he aided Scattered Spider in at least four breaches; the allegations are not proof of guilt.
Key points
- Stokes was extradited from Finland and remains in custody after appearing in federal court in Chicago.
- Prosecutors allege he was a Scattered Spider member involved in at least four breaches, including a March 2023 intrusion at an online communications platform.
- In a May 2025 case, hackers allegedly impersonated employees to a luxury retailer’s help desk to reset credentials and access administrator accounts.
- The attackers allegedly demanded $8 million and claimed to have stolen 100 GB of data; the retailer refused to pay and reportedly incurred more than $2 million in disruption and remediation costs.
- Stokes faces fraud, conspiracy and computer-intrusion charges.
- The article says Scattered Spider has used social engineering, MFA fatigue attacks and SMS credential phishing to steal credentials and sensitive documents for extortion.
Article Details
- Event Type
- Extradition to the United States and criminal charges against a person accused of participating in Scattered Spider cyber intrusions.
- Impact
- Prosecutors allege Peter Stokes participated in at least four breaches and helped extort companies. In one alleged May 2025 breach, attackers demanded $8 million and claimed to have stolen 100 gigabytes of data; the company refused to pay but reportedly incurred more than $2 million in disruption and remediation costs. The article also cites officials saying Scattered Spider has been involved in over 100 intrusions, more than $100 million in ransom payments, and additional victim losses.
MITRE ATT&CK
People
Threat Actors
0ktapusName listed in the article as another tracking name for Scattered Spider, the group accused of intrusions and extortion.BouquetOnline handle used by Peter Stokes, who is accused of participating in Scattered Spider breaches.JordanOnline handle used by Peter Stokes, who is accused of participating in Scattered Spider breaches.Peter StokesAccused of being a Scattered Spider member and participating in at least four breaches; these allegations have not been established as facts in the article.Scatter SwineName listed in the article as another tracking name for Scattered Spider, the group accused of intrusions and extortion.Scattered SpiderHacking collective accused of network intrusions, extortion, social engineering, MFA bombing, and credential phishing.SpencerOnline handle used by Peter Stokes, who is accused of participating in Scattered Spider breaches.UNC3944Name listed in the article as another tracking name for Scattered Spider, the group accused of intrusions and extortion.
Malware
Tools
Countries
Finlandfrom Finland.United Kingdomknit hacking collective mainly composed of teenagers and young adults from the United States and Great Britain.United StatesPeter Stokes, a dual U.S. and Estonian citizen, has been extradited to the United States after being accused of helping Scattered Spider extort millions from global companies.