On June 30, 2026, Peter Stokes, a 19-year-old dual citizen from the United States and Estonia, found himself in a Chicago federal courtroom after being extradited from Finland. Following his arrival, the court ordered his detention.
Just a day later, on July 1, the Department of Justice unveiled serious charges against him, linking him to the cybercrime collective known as Scattered Spider, which has gained notoriety as one of the most active hacking groups in recent history. The specific allegation revolves around a significant cyber breach in May 2025 at an unnamed luxury jewelry retailer, where criminals compromised data and issued a demand for $8 million in cryptocurrency.
Despite the threat, the jeweler chose not to pay the ransom and subsequently faced at least $2 million in damages due to the fallout from the attack, including investigation costs and system recovery.
Stokes's legal troubles began when he was apprehended in Finland in April 2026, following an Interpol Red Notice that led local law enforcement to seize his two 2-terabyte hard drives at the Helsinki airport. This seizure hints at the vast amount of sensitive data potentially connected to illegal hacking activities.
Prosecutors claim that Stokes had been engaged in cyber intrusions since he was just 16, placing his first suspected activity around 2023, during the peak operations of Scattered Spider.
That group, also recognized under various aliases like UNC3944, Octo Tempest, and 0ktapus, has been implicated in over 100 hacking incidents, resulting in ransom payments exceeding $100 million alongside considerable collateral damage for the affected organizations.
What methods does Scattered Spider use?
Scattered Spider typically employs voice phishing, commonly referred to as vishing, targeting employees by impersonating IT staff or trusted internal figures to extract login credentials. After gaining access to a network, these criminals typically move laterally within it to exfiltrate sensitive data and create leverage for ransom demands, paid typically in cryptocurrency.
The group’s high-profile victims include major entities like MGM Resorts and Caesars Entertainment, both of which faced attacks in 2023. Reports indicate that Caesars paid a staggering $15 million to resolve its issues, while MGM opted against paying the ransom, incurring losses estimated at over $100 million.
What does this mean for law enforcement?
The case against Stokes is part of a broader crackdown on Scattered Spider. Several members of this group have faced arrests and pleaded guilty throughout 2025 and 2026. The ongoing coordinated law enforcement efforts demonstrate the international challenge posed by cybercrime and the need for cross-border collaboration to bring perpetrators to justice.
With the Interpol Red Notice and the extradition process in Stokes' case, the role of international cooperation is underscored. Finnish authorities carried out the initial arrest and evidence collection, while US prosecutors are tasked with building the federal case in Chicago.