Alleged Scattered Spider Hacker Extradited to the U.S. After Arrest in Finland

Alleged Scattered Spider Hacker Extradited to the U.S. After Arrest in Finland

The U.S. Department of Justice (DOJ) and the Federal Bureau of Investigation (FBI) have announced the arrest and extradition of Peter Stokes, an alleged member of the notorious cybercriminal group known as Scattered Spider.

Stokes, a 19-year-old dual U.S.-Estonian citizen, was arrested by Finnish authorities in April following an Interpol Red Notice and extradited to the United States last week. He is facing federal charges, including conspiracy, computer intrusion, and fraud. He has since made his initial appearance in a federal court in Chicago, where he was ordered to remain in custody pending further proceedings.

Who Is Scattered Spider?

Scattered Spider, also known as Octo Tempest, UNC3944, and 0ktapus, is a cybercriminal group linked to more than 100 network intrusions targeting companies across the United States.

The group is known for using sophisticated social engineering tactics, including SIM-swapping attacks and impersonating employees to gain unauthorized access to corporate systems. Authorities say these attacks have resulted in more than $100 million in ransom payments and millions of dollars in additional losses due to business disruption and recovery costs.

Allegations Against Stokes

According to the criminal complaint, Stokes allegedly participated in several cyberattacks, including a 2025 breach of a luxury jewelry retailer. Prosecutors allege that the attackers stole company data and demanded approximately $8 million in cryptocurrency as ransom. Although the company did not pay the ransom, it reportedly suffered losses exceeding $2 million due to business disruption and incident response efforts.

Part of Operation Riptide

The arrest is part of Operation Riptide, the FBI's ongoing initiative to identify, disrupt, and prosecute cybercriminals responsible for cyber-enabled fraud, ransomware attacks, and other forms of online crime targeting U.S. victims.

The operation relies heavily on international cooperation, demonstrating that cybercriminals can face prosecution regardless of where they operate. Finnish authorities worked closely with U.S. law enforcement to facilitate Stokes' arrest and extradition.

A Reminder About Cybersecurity

The case highlights the growing threat posed by social engineering attacks and SIM-swapping schemes. Organizations are encouraged to strengthen employee security awareness, implement multi-factor authentication, and adopt robust identity verification procedures to reduce the risk of unauthorized access.

Disclaimer: The charges against Peter Stokes are allegations. Under U.S. law, he is presumed innocent unless and until proven guilty in a court of law.