A dual United States and Estonian citizen has been extradited to the U.S. to face charges alleging he was a member of the Scattered Spider hacking collective.
19-year-old Peter Stokes (who used the online handles "Bouquet," "Spencer," and "Jordan") was arrested in Finland on April 10 while attempting to board a flight to Japan at Helsinki's airport and is accused of having helped extort millions of dollars from multiple high-profile companies worldwide.
According to court documents, Stokes was involved in at least four Scattered Spider breaches (including a March 2023 hack of an online communication platform, when he was 16 years old) that led to victim companies being asked to pay millions of dollars in ransoms.
The list of victims breached with the suspect's help also includes an unnamed multibillion-dollar "luxury item retailer" in May 2025, when the hackers allegedly called the company's IT helpdesk, posing as employees, to reset credentials and gain access to administrator accounts.
While the threat actors demanded an $8 million ransom, claiming to have 100 gigabytes of stolen data, the company refused to pay. However, it still incurred over $2 million due to operations disruption and remediation costs.
Stokes now faces charges of fraud, conspiracy, and computer intrusion and has remained in custody after appearing in federal court in Chicago on Tuesday.
Peter Stokes (U.S. Department of Justice)
"The criminal complaint charges Peter Stokes with membership in Scattered Spider, a hacking group that has been involved in over 100 network intrusions, resulting in more than $100 million in ransom payments and millions more in damages to the victims," said Assistant Attorney General A. Tysen Duva on Wednesday.
"Scattered Spider has repeatedly targeted U.S. companies, extorting employees, inflicting millions of dollars in losses, and disrupting essential operations," added Assistant Director Brett Leatherman of the FBI's Cyber Division.
They are known for using a blend of social engineering, targeted multi-factor authentication (MFA) bombing (aka MFA fatigue), and SMS credential phishing attacks to steal user credentials and sensitive documents for extortion leverage after breaching their targets' networks.
Post a Comment Community Rules
You need to login in order to post a comment
Not a member yet? Register Now
<small>Source: Bleeping Computer</small>
