US Extradites Alleged Scattered Spider Hacker from Finland
A 19-year-old dual US-Estonian national, identified as Peter Stokes, has been extradited to the United States following his arrest in Finland in April. Stokes faces charges of conspiracy, computer intrusion, and fraud, according to the US Department of Justice (Yle).
Stokes was detained at Helsinki Airport based on an Interpol red notice. The US authorities allege he is a member of the cybercriminal group Scattered Spider, also known as Octo Tempest, UNC3944, or 0ktapus (Euronews). The group is accused of carrying out over 100 network intrusions, resulting in more than $100 million in ransom payments and millions in damages (Yle).
Alleged Cyberattack on Luxury Jewelry Retailer
The criminal complaint against Stokes alleges that he and his coconspirators targeted a luxury jewelry retailer’s computer system in May 2025. The group exfiltrated data and demanded a ransom of approximately $8 million in cryptocurrency. While no ransom was paid after the company’s security team removed the threat actors, the retailer reportedly suffered losses of at least $2 million due to business disruption, investigation, and mitigation efforts (Euronews).
Global Cybercrime Operations
Scattered Spider has been linked to high-profile cyberattacks worldwide, including in the US and the UK. In June, two UK men—Thalha Jubair, 20, and Owen Flowers, 18—pleaded guilty to breaching Transport for London’s (TfL) network in August and September 2024. The attack forced all 28,000 TfL employees to reset their passwords in person, with the organization reporting £29 million in losses and recovery costs (Euronews).
Paul Foster, head of the UK’s National Crime Agency’s National Cyber Crime Unit, stated that the case highlights the growing threat from cybercriminals based in English-speaking countries, with Scattered Spider serving as a prime example (Euronews).
The US Department of Justice has not disclosed why Stokes was in Finland at the time of his arrest (Yle). Finnish media, including Iltasanomat, were the first to report on the extradition.
