U.S. Charges Suspected Scattered Spider Member Arrested in Finland
Summary
A 19-year-old known as “Bouquet” was arrested in Finland and faces U.S. charges. Prosecutors allege he took part in four Scattered Spider breaches, including a 2025 retailer incident involving an $8 million demand and over $2 million in costs.
Key points
- Prosecutors allege the 19-year-old dual U.S.-Estonian citizen, known online as “Bouquet,” participated in at least four Scattered Spider breaches.
- He was reportedly arrested at Helsinki airport on April 10 while attempting to board a flight to Japan and faces wire fraud, conspiracy, and computer intrusion charges.
- In an alleged May 2025 incident, hackers posed as employees when contacting an unnamed luxury retailer’s IT helpdesk, reset credentials, and accessed administrator accounts.
- The hackers allegedly claimed to have stolen 100 gigabytes of data and demanded $8 million; the retailer refused to pay but reportedly incurred more than $2 million in disruption and remediation costs.
- Prosecutors also allege Bouquet took part in a March 2023 breach of an online communication platform when he was 16.
- The article says Scattered Spider is known for social engineering, MFA fatigue, and SMS credential phishing; these are group-level descriptions, not findings specific to the charged suspect.
Article Details
- Event Type
- Arrest in Finland and U.S. federal charges against a suspect accused of participating in Scattered Spider breaches and extortion campaigns.
- Impact
- Prosecutors allege the suspect was involved in at least four breaches. In a May 2025 incident, a luxury retailer reportedly faced an $8 million ransom demand and incurred more than $2 million in disruption and remediation costs despite refusing to pay. The article also describes ransom payments or demands totaling millions across victims.
Threat Actors
0ktapusName the article identifies as another tracking name for Scattered Spider, the collective associated with alleged breaches and extortion.Peter StokesOnline alias of the suspect, whom prosecutors allege participated in at least four Scattered Spider breaches and extortion activity; the allegations are not presented as established guilt.Scatter SwineName the article identifies as another tracking name for Scattered Spider, the collective associated with alleged breaches and extortion.Scattered SpiderCybercrime collective whose alleged activities include breaches and extortion. The article attributes social engineering, MFA bombing, and SMS credential phishing to the group.StarfraudName the article identifies as another tracking name for Scattered Spider, the collective associated with alleged breaches and extortion.Tyler Robert BuchananThe article describes him as believed to be one of Scattered Spider’s leaders and reports that he pleaded guilty in the United States to wire fraud and aggravated identity theft charges.UNC3944Name the article identifies as another tracking name for Scattered Spider, the collective associated with alleged breaches and extortion.
Countries
FinlandA 19-year-old dual U.S.-Estonian citizen using the alias “Bouquet” was arrested in Finland and faces U.S.JapanThe suspect, known online as “Bouquet,” was arrested at Helsinki airport on April 10 while trying to fly to Japan and now faces U.S.United Kingdomand Great Britain.United StatesA 19-year-old dual U.S.-Estonian citizen using the alias “Bouquet” was arrested in Finland and faces U.S.