Alleged Scattered Spider Member, 19, Extradited to the United States
A 19-year-old dual United States and Estonian citizen has been extradited to the U.S. to face charges alleging membership in the Scattered Spider hacking collective, BleepingComputer reported. Peter Stokes, who prosecutors say operated under the online handles “Bouquet,” “Spencer,” and “Jordan,” was arrested in Finland on April 10 while attempting to board a flight to Japan at Helsinki airport. He appeared in federal court in Chicago and remains in custody on charges of fraud, conspiracy, and computer intrusion.
According to court documents, Stokes participated in at least four Scattered Spider breaches, including a March 2023 intrusion at an online communication platform carried out when he was just 16 years old. In a May 2025 attack on an unnamed multibillion-dollar luxury retailer, the hackers allegedly phoned the company’s IT helpdesk posing as employees to reset credentials and obtain administrator access, then demanded an $8 million ransom while claiming to hold 100 gigabytes of stolen data. The company refused to pay but still incurred more than $2 million in disruption and remediation costs.
The U.S. Department of Justice says Scattered Spider has been linked to over 100 network intrusions that generated more than $100 million in ransom payments, plus millions more in damages. The group — also tracked as 0ktapus, Octo Tempest, UNC3944, and Muddled Libra — emerged in 2022 as a loose collective of mostly teenagers and young adults from the U.S. and UK, known for social engineering, MFA fatigue attacks, and SMS phishing. Its victim list includes Caesars Entertainment, MGM Resorts, Marks & Spencer, Co-op, WestJet, and Jaguar Land Rover.
The extradition is the latest in a series of law enforcement actions against the group’s alleged members on both sides of the Atlantic, underscoring prosecutors’ increasing focus on the young, English-speaking social-engineering crews behind some of the most damaging corporate breaches of recent years.