The Justice Department announced today that Peter Stokes, 19, an alleged member of the cybercrime group Scattered Spider, has been extradited from Finland to the United States and now faces federal charges in the Northern District of Illinois.

According to the DOJ, Stokes, a dual citizen of the United States and Estonia, was arrested by Finnish authorities in April under an Interpol Red Notice and extradited last week. A criminal complaint was unsealed Tuesday, and Stokes made his initial appearance the same day in federal court in Chicago, where he was ordered to stay in custody. He is charged with conspiracy, computer intrusion, and fraud.
The department described Scattered Spider, also tracked as Octo Tempest, UNC3944, and 0ktapus, as a group that breaks into corporate employee accounts through deception, encrypts or steals company data, and then extorts cryptocurrency to hand it back or keep it from leaking. The DOJ said the group has been tied to more than 100 network intrusions and over $100 million in ransom payments, plus millions more in victim damages.
The only financial conduct the DOJ ties directly to Stokes is a May 2025 breach of a luxury jewelry retailer. Prosecutors allege Stokes and co-conspirators broke into the retailer's systems, stole data, and demanded roughly $8 million in cryptocurrency. The company's security team forced the intruders out and paid nothing, but the DOJ says it still lost at least $2 million to disruption, investigation, and cleanup.
Stokes his online moniker, "Bouquet," alleged membership in Scattered Spider since Stokes was 16, and participation in at least four intrusions. The complaint reportedly says he displayed unusual wealth for his age, posting images from luxury hotels and trips to Mexico, Dubai, Thailand, and Europe, along with cash spreads and a diamond chain reading "HACK THE PLANET." He was detained on April 10 this year while boarding a flight to Tokyo. The DOJ release itself does not include these lifestyle details.
Get the ICD Newsletter
Subscribe for source-forward cyber news, OSINT notes, breach updates, and analysis. Have evidence or a lead? Send it to ICD.