19-Year-Old Scattered Spider Hacker Extradited to U.S. for Cybercrime Spree
A 19-year-old dual U.S.-Estonian citizen, Peter Stokes, was extradited from Finland to Chicago this week to face federal charges tied to his alleged role in the Scattered Spider cybercrime group. Stokes appeared in court on Tuesday, where he was accused of conspiracy, cyber intrusion, and fraud, according to the Department of Justice.
The FBI’s complaint centers on a May 2025 breach of an unnamed luxury jewelry retailer (Company F), where Stokes and other group members allegedly stole data and demanded an $8 million cryptocurrency ransom. Using social engineering tactics, the attackers impersonated employees to reset authentication credentials, compromising three accounts including two belonging to IT administrators with high-level access within hours. They then used ngrok, a legitimate traffic-management tool, to maintain persistent access to the company’s data center. Though the ransom went unpaid, the breach resulted in $2 million in losses from business disruption and mitigation efforts.
Stokes is also accused of breaching an online communication platform (Company H) in March 2023. Operating under aliases like “Bouquet,” “Spencer,” and “Jordan,” he was arrested in Finland in April following an Interpol Red Notice. The Chicago Tribune previously reported his detention earlier this year.
Scattered Spider, a loosely organized English-speaking collective, has been linked to over 100 network intrusions, including attacks on U.S. casinos, a federal court system, and London’s transport agency. The group is estimated to have extorted more than $100 million in ransom payments. Stokes remains in custody following his court appearance.
Source: https://therecord.media/teen-suspect-in-scattered-spider-hacks-extradited-to-us
Federal Compass cybersecurity rating report: https://www.rankiteo.com/company/federal-compass
"id": "FED1782938583",
"linkid": "federal-compass",
"type": "Cyber Attack",
"date": "5/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'retail',
'name': 'Company F',
'type': 'luxury jewelry retailer'},
{'industry': 'technology',
'name': 'Company H',
'type': 'online communication platform'}],
'attack_vector': 'social engineering',
'data_breach': {'data_exfiltration': True},
'date_detected': '2025-05',
'description': 'A 19-year-old dual U.S.-Estonian citizen, Peter Stokes, was '
'extradited from Finland to Chicago to face federal charges '
'tied to his alleged role in the Scattered Spider cybercrime '
'group. The FBI’s complaint centers on a May 2025 breach of an '
'unnamed luxury jewelry retailer (Company F), where Stokes and '
'other group members allegedly stole data and demanded an $8 '
'million cryptocurrency ransom. The attackers used social '
'engineering tactics to compromise IT administrator accounts '
'and maintained persistent access using ngrok. Stokes is also '
'accused of breaching an online communication platform '
'(Company H) in March 2023.',
'impact': {'data_compromised': True,
'financial_loss': '$2 million',
'operational_impact': 'business disruption and mitigation efforts',
'systems_affected': 'data center, IT administrator accounts'},
'initial_access_broker': {'backdoors_established': 'ngrok for persistent '
'access',
'entry_point': 'social engineering (employee '
'impersonation)',
'high_value_targets': 'IT administrators'},
'investigation_status': 'ongoing',
'motivation': ['financial gain', 'data exfiltration'],
'post_incident_analysis': {'root_causes': 'compromised authentication '
'credentials via social '
'engineering'},
'ransomware': {'data_exfiltration': True,
'ransom_demanded': '$8 million (cryptocurrency)'},
'references': [{'source': 'Department of Justice'},
{'source': 'Chicago Tribune'}],
'regulatory_compliance': {'legal_actions': 'federal charges (conspiracy, '
'cyber intrusion, fraud)'},
'response': {'law_enforcement_notified': True},
'threat_actor': 'Scattered Spider',
'title': '19-Year-Old Scattered Spider Hacker Extradited to U.S. for '
'Cybercrime Spree',
'type': ['ransomware', 'data breach'],
'vulnerability_exploited': 'compromised authentication credentials'}