The US Justice Department has announced the arrest and extradition of a teenager accused of various hacking-related offenses as part of the infamous Scattered Spider group.
Peter Stokes, 19, is a dual US and Estonian citizen but was arrested in Finland in April, according to a criminal complaint unsealed on June 30.
The teen was extradited to the US last week and has been charged with conspiracy, computer intrusion, and fraud, according to the DoJ.
“The criminal complaint charges Peter Stokes with membership in Scattered Spider, a hacking group that has been involved in over 100 network intrusions, resulting in more than $100m in ransom payments and millions more in damages to the victims,” said assistant attorney general A. Tysen Duva of the Justice Department’s Criminal Division.
“The charges unsealed today are the result of years of work by the Criminal Division, the US Attorney’s Office for the Northern District of Illinois, and the FBI. We will continue to partner to ensure that cybercriminals cannot evade the reach of the United States.”
Read more on Scattered Spider: Cybercriminals ‘Spooked’ After Scattered Spider Arrests.
Stokes is accused of conspiring with other members of the group to breach the network of a luxury jewelry retailer, steal data and attempt to extort the firm for $8m. According to the DoJ, the company didn’t pay, but it still suffered losses of $2m+ due to business disruption, incident response and other associated costs.
Is the Net Closing on Scattered Spider?
Although the charges at this time are not proven, Stokes would fit the alleged profile of Scattered Spider members, who tend to be young men.
His arrest follows the conviction of two youngsters last week for hacking Transport for London (TfL) in an attack which cost the transport authority an estimated £29m ($38m) in losses and recovery costs.
One of the duo, Thalha Jubair, 20, from East London, is wanted in the US, according to charges unsealed in September 2025.
They allege he participated in at least 120 computer network intrusions and extortion involving 47 US entities, with victims paying $115m or more in ransom payments to Jubair and his associates.
In 2024, a young Florida man was sentenced to 10 years in prison after pleading guilty to federal charges linked to cybercrime, including conspiracy and wire fraud.
According to reports, Noah Michael Urban, 20, was a core member of Scattered Spider.
However, as the name suggests, it is a loose association of hackers rather than a cohesive movement with a single leader.
Last year, some members seemed to join forces with others from Lapsus$ and ShinyHunters to form Scattered Lapsus$ Hunters. However, it was recently claimed that the group’s claims it was responsible for the Jaguar Land Rover (JLR) breach were false.