Alleged Member of Criminal Cyber Hacking Group “Scattered Spider” Arrested in Finland and Extradited to United States

CHICAGO - An alleged member of the criminal cyber hacking group Scattered Spider has been arrested in Finland and extradited to the United States to face federal criminal conspiracy charges in the Northern District of Illinois.

A criminal complaint unsealed Tuesday in U.S. District Court in Chicago charges PETER STOKES, 19, a dual citizen of the United States and Estonia, with conspiracy, cyber intrusion, and fraud offenses. Stokes was arrested by Finnish authorities in April pursuant to an Interpol Red Notice and extradited to the United States last week. He made an initial appearance on Tuesday in federal court in Chicago and was ordered to remain detained in law enforcement custody.

According to the complaint, Scattered Spider, also known as "Octo Tempest," "UNC3944," and "0ktapus," is a group of criminal cyber actors that has been involved with more than 100 network intrusions, resulting in more than approximately $100 million in ransom payments and millions of dollars in damages to the victims. The group has targeted numerous corporate victims in the United States by gaining access to companies' employee accounts through fraudulent pretenses, encrypting the companies' data or exfiltrating it to remote servers, and then extorting cryptocurrency from the companies to regain control over their data or prevent the dissemination of the data.

The complaint against Stokes describes a cyber intrusion in May 2025 against a luxury jewelry retailer. Stokes and likely other co-conspirators breached the retailer's computer system, exfiltrated data from the company, and made a ransom demand of approximately $8 million in cryptocurrency, the complaint states. The retailer's security personnel successfully evicted the threat actors from the company's computer network and no ransom was paid. The retailer nonetheless suffered a loss of at least $2 million due to business disruption, investigation, and mitigation of the threat.

The charges and extradition were announced by A. Tysen Duva, Assistant Attorney General of the Justice Department's Criminal Division, Andrew S. Boutros, United States Attorney for the Northern District of Illinois, and Douglas S. DePodesta, Special Agent-in-Charge of the Chicago Field Office of the FBI. The FBI's Copenhagen Law Enforcement Attaché Office and the FBI Las Vegas Field Office assisted. The government is represented by Assistant U.S. Attorneys Jennifer Chang and Ann Marie Ursini of the Northern District of Illinois, and Assistant Deputy Chief Adrienne L. Rose of the Justice Department's Computer Crime and Intellectual Property Section (CCIPS). The Justice Department's Office of International Affairs worked with Finnish authorities to secure the extradition of Stokes. The Department of Justice acknowledges and appreciates the assistance of Finland's National Bureau of Investigation in this matter.

"The criminal complaint charges Peter Stokes with membership in Scattered Spider, a hacking group that has been involved in over 100 network intrusions, resulting in more than $100 million in ransom payments and millions more in damages to the victims," said Assistant Attorney General Duva. "The charges unsealed today are the result of years of work by the Criminal Division, the U.S. Attorney's Office for the Northern District of Illinois, and the FBI. We will continue to partner to ensure that cybercriminals cannot evade the reach of the United States."

"The malicious attacks from Scattered Spider caused widespread disruption to businesses and organizations throughout the United States," said U.S. Attorney Boutros. "As Co-Chair of the White Collar, Cyber, and Crypto Subcommittee of Acting Attorney General Blanche's Advisory Committee, I am acutely aware of the significant and growing threat posed by brazen cyber criminals. These charges underscore our unwavering commitment to keeping pace with technologically savvy criminal actors and holding accountable those who seek to profit from cyber intrusions, including those located in foreign jurisdictions who do harm to American businesses and victims."

"The responsibility of protecting our nation's security and welfare extends beyond our borders, over international territories, and most critically, in the cyber universe," said FBI SAC DePodesta. "Thanks to our international partnerships and cross-agency collaboration, the FBI successfully identified a known Scattered Spider actor alleged to have targeted hardworking Americans and critical infrastructure. The FBI will stop at nothing to ensure that Americans are free from attacks and danger, wherever it may be lurking."

This action is part of Operation Riptide, an ongoing FBI campaign targeting the criminal actors, infrastructure, and financial networks behind cybercrime, cyber-enabled crime, and fraud against the American people. Last year, Americans reported over $20 billion in losses to cybercrime, a 26 percent single-year increase. Operation Riptide is the FBI's sustained enforcement response to that threat.

The public is reminded that a complaint is not evidence of guilt. The defendant is presumed innocent and entitled to a fair trial at which the government has the burden of proving guilt beyond a reasonable doubt.