Scattered Spider Suspect Extradited to U.S. to Face Hacking Charges
Summary
Peter Stokes, 19, was extradited from Finland to face U.S. hacking, conspiracy and fraud charges tied to alleged Scattered Spider intrusions. Prosecutors say one 2025 attack sought $8 million in cryptocurrency; Stokes is presumed innocent.
Key points
- Peter Stokes, 19, was extradited from Finland and appeared in a Chicago federal court on charges of conspiracy, computer intrusion and fraud.
- Court records describe at least four alleged intrusions linked to Stokes, identified by the handle “Bouquet.”
- Prosecutors allege that a May 2025 intrusion targeted a luxury jewelry retailer, copied data and demanded about $8 million in cryptocurrency. Stokes is presumed innocent.
- Scattered Spider is described as using social engineering, including impersonating employees to persuade help desks to reset passwords or approve logins.
- The article describes recent U.S. and U.K. cases involving other alleged or convicted Scattered Spider members as part of a broader crackdown.
- The recommended defenses include stronger identity checks before password resets and phishing-resistant sign-in keys.
Article Details
- Event Type
- Extradition of Peter Stokes, accused of belonging to Scattered Spider, to face U.S. conspiracy, computer intrusion, and fraud charges.
- Impact
- Prosecutors allege that Stokes and others intruded on a luxury jewelry retailer in May 2025, copied data, and demanded about $8 million in cryptocurrency. The retailer refused to pay and spent at least $2 million on cleanup. Stokes is presumed innocent and the case remains pending.
MITRE ATT&CK
People
Threat Actors
0ktapusName under which security companies also track Scattered Spider.Noah UrbanIdentified as a Scattered Spider member; he was sentenced to 10 years and ordered to repay about $13 million.Owen FlowersPleaded guilty with Thalha Jubair to a 2024 attack on Transport for London and admitted conspiring to hack two U.S. health systems.Peter StokesAccused of belonging to Scattered Spider and facing U.S. charges of conspiracy, computer intrusion, and fraud. Prosecutors allege he and others intruded on a luxury jewelry retailer and demanded about $8 million in cryptocurrency. Court records identify his handle as “Bouquet.” He is presumed innocent.Scattered SpiderA loose group described as using social engineering and help desk deception to gain access to organizations, steal files, and threaten to leak them unless paid.Thalha JubairPleaded guilty with Owen Flowers to a 2024 attack on Transport for London; the article identifies them as young men in the U.K. and links the case to the Scattered Spider crackdown.Tyler Robert BuchananDescribed as a former Scattered Spider ringleader; he pleaded guilty to fraud and identity theft and admitted stealing at least $8 million in cryptocurrency through phishing campaigns targeting companies.UNC3944Name under which security companies also track Scattered Spider.
Vendors
Countries
FinlandPeter Stokes was extradited from Finland to face U.S.ScotlandTyler Buchanan, a 24-year-old from Scotland, who was once described as a ringleader, pleaded guilty in a U.S.United KingdomIt is a loose, mostly English-speaking group of young people, many of them teenagers, spread across the U.S., U.K., and Europe.United StatesPeter Stokes was extradited from Finland to face U.S.