A 19-year-old dual US-Estonian national has been arrested in Finland and extradited to the United States on charges connected to the notorious Scattered Spider cybercriminal network, the US Department of Justice announced on Wednesday. Peter Stokes appeared in federal court in Chicago on Tuesday, where he was ordered to remain in custody. He faces charges of computer intrusion, conspiracy, and fraud, following an Interpol Red Notice that prompted his April arrest by Finland's National Bureau of Investigation working alongside FBI agents based in Copenhagen and Chicago.
According to a criminal complaint, Stokes and co-conspirators targeted a luxury jewellery retailer in May 2025, stealing data from the company and demanding roughly $8 million in cryptocurrency as ransom. The unnamed firm's security team managed to remove the attackers from its network before any payment was made, but still suffered losses of at least $2 million due to business disruption, investigation costs, and mitigation efforts.
Scattered Spider — also known by the aliases Octo Tempest, UNC3944, and 0ktapus — is a loosely organised network of cybercriminals believed to consist primarily of young, native English speakers from the US and UK. The FBI has linked the group to more than 100 network intrusions, resulting in over $100 million in ransom payments and millions more in additional damages across targets worldwide.
The arrest of Stokes follows guilty pleas entered last month in the UK by two men connected to a 2024 cyberattack on Transport for London, the government body responsible for the British capital's travel network. Thalha Jubair, 20, and Owen Flowers, 18, breached TfL's systems between 31 August and 3 September 2024, compromising data belonging to around 10 million people and forcing all 28,000 TfL employees to attend in-person password resets. The organisation reported £29 million in losses and recovery costs. The UK's National Crime Agency has also identified Scattered Spider as central to its investigation into separate cyberattacks on major British retailers Co-op and M&S.
The case underscores a growing law enforcement focus on English-speaking cybercriminal networks. "The profile of offenders like Flowers and Jubair demonstrates the increasing threat from cyber criminals based in the UK and other English-speaking countries, epitomised by Scattered Spider," said Paul Foster, head of the NCA's National Cyber Crime Unit. The DoJ described Stokes's arrest as the product of "years of work," signalling that further prosecutions may be forthcoming.