In brief
In April a 19‑year‑old named Peter Stokes was taken into custody in Finland and sent to Chicago under an Interpol Red Notice. The U.S. Department of Justice says he was part of the Scattered Spider hacking collective that stole data from a luxury jeweller and demanded an $8 million ransom in cryptocurrency—no ransom was paid, but the victim lost about $2 million in business disruption. He faces charges of computer intrusion, conspiracy and fraud. The case follows two other young men who pleaded guilty in 2024 for a Transport for London cyber‑attack believed to be run by the same group.
In a rare cross‑border case, a 19‑year‑old student with dual U.S. and Estonian citizenship was seized by Finnish police in April and later extradited to the United States. The extradition followed an Interpol Red Notice and is part of a wider targeting of a cyber‑crime network known as Scattered Spider.
The U.S. Department of Justice says the teenager participated in a scheme that stole sensitive data from a high‑end jewellery retailer last year and demanded an $8 million ransom in cryptocurrency. While the company did not pay the ransom, it suffered an estimated $2 million loss due to business disruption, forensic investigations and security mitigation.
Stokes appeared before a federal court in Chicago on Tuesday and was ordered to remain in custody. Prosecutors allege that he and other members of the group conspired to infiltrate corporate networks, exfiltrate data and threaten victims with financial harm.
The case follows earlier guilty pleas by two young men linked to a 2024 Transport for London cyber‑attack, which the National Crime Agency believes was carried out by Scattered Spider. That incident saw more than 10 million user account details compromised and a significant intrusion into the city's network.
Investigators—working in Copenhagen, Chicago and Finland—have linked the shop‑lifting spree, the jewellery hack and the TfL breach to the same young, native English‑speaking criminals from the U.S. and U.K. The investigation also implicates the group in attacks on other retailers such as Co‑op and M & S last year.
