A 19-year-old dual US and Estonian citizen has been extradited to the United States to face charges linked to the Scattered Spider hacking group.
Peter Stokes was arrested in Finland in April while trying to board a flight to Japan. US prosecutors say he helped carry out cyberattacks that targeted several major companies and led to ransom demands worth millions of dollars.
Court documents say Stokes took part in at least four cyberattacks, including one in 2023 when he was 16. In another attack in 2025, hackers allegedly tricked an IT help desk into resetting employee passwords, allowing them to access company systems.
The attackers demanded an $8 million ransom, but the company refused to pay. Nethertheless, the breach reportedly caused more than $2 million in recovery and disruption costs.
Stokes is charged with fraud, conspiracy, and computer intrusion. He appeared in federal court in Chicago and remains in custody.
Scattered Spider is a hacking group that became active in 2022. Its members are believed to be mostly teenagers and young adults from the United States and the United Kingdom. The group is known for using social engineering, phishing, and fake IT support calls to steal login details and gain access to company networks.
The group has been linked to attacks on several well-known enterprises, including MGM Resorts, Caesars, Reddit, Twilio, Marks & Spencer, Harrods, WestJet, and Jaguar Land Rover.