Peter Stokes, 19, was arrested in April 2026 in Finland and extradited to the United States following an Interpol Red Notice.
The U.S. Department of Justice (DoJ) has charged him with computer intrusion, conspiracy and fraud, saying the offence stemmed from a “years of work” by the Scattered Spider hacking group.
Scattered Spider has been implicated in hacks that have generated more than $100 million in ransom payments. The group is believed to consist of young, native English‑speaking operatives from the United States and the United Kingdom.
Stokes is not the only suspect in the DoJ’s investigation. Two other young men pleaded guilty in the same year to offences linked to a £39 million cyber‑attack on Transport for London, an attack the U.K. National Crime Agency (NCA) believes Scattered Spider carried out.
The DoJ alleges that Stokes, acting with other co‑conspirators, stole data from a luxury jewellery retailer and demanded roughly $8 million in cryptocurrency. The company evicted the hackers, and no ransom was paid, but the retailer suffered losses of at least $2 million due to disruption, investigation and mitigation.
The FBI, in cooperation with Finland’s National Bureau of Investigation, led the arrest operation. Stokes appeared in federal court in Chicago on Tuesday and was ordered to remain in custody.
Charges against Stokes follow the NCA’s investigations into cyber attacks on British retailers Co‑op and M&S last year, where comparable tactics were identified as part of Scattered Spider’s operations.
The DoJ’s statements underscore the international reach of the group’s operations, with crimes spanning multiple countries and affecting high‑profile targets.
