Federal prosecutors say a 19-year-old with ties to Estonia was arrested in Finland and flown to the United States to face charges tied to a sprawling cybercrime campaign. The case centers on alleged membership in Scattered Spider, a group accused of dozens of corporate intrusions and large ransom demands.
Authorities arrested Peter Stokes, 19, after an Interpol Red Notice led Finnish police to take him into custody in April, and he was extradited to face federal charges in the Northern District of Illinois. Stokes made an initial appearance in Chicago and was ordered to remain detained while the case proceeds. The criminal complaint unsealed in federal court lists conspiracy, cyber intrusion, and fraud counts against him.
The indictment links Stokes to Scattered Spider, a criminal collective known by several names, including Octo Tempest, UNC3944, and 0ktapus. Prosecutors say the group has been tied to more than 100 network intrusions, triggering roughly $100 million in ransom payments and causing millions more in recovery costs. Investigators describe a pattern of sophisticated social engineering, credential theft, and exploitation of employee accounts to gain corporate access.
Once inside corporate networks, the accused actors allegedly encrypted systems or exfiltrated sensitive data and then demanded cryptocurrency to restore access or to prevent public disclosure. Victims reported operational shutdowns, forensic costs, regulatory exposure, and customer harm stemming from those attacks. The FBI and Justice Department have made cyber extortion a top enforcement priority because of its outsized impact on businesses and infrastructure.
The complaint details a May 2025 intrusion at a luxury jewelry retailer that prosecutors say involved Stokes and others. According to the filing, the actors breached the retailer’s systems, removed data, and sought about $8 million in cryptocurrency as ransom. Security teams at the retailer ultimately evicted the intruders, no ransom was paid, but the company still suffered at least $2 million in losses from business disruption, investigation, and mitigation.
Officials announced the charges and extradition together, with top Justice Department and U.S. Attorney’s Office leaders named as spokespeople in the case. Law enforcement assistance crossed borders: the FBI’s Copenhagen Law Enforcement Attaché and a Nevada field office were involved, and Finland’s National Bureau of Investigation helped secure the transfer. The Department of Justice’s Office of International Affairs coordinated the legal work to move the case forward.
“The criminal complaint charges Peter Stokes with membership in Scattered Spider, a hacking group that has been involved in over 100 network intrusions, resulting in more than $100 million in ransom payments and millions more in damages to the victims,” said Assistant Attorney General Duva. The statement underscores the investigative effort and signals continued international cooperation aimed at cybercriminal networks.
The government is presenting the case with a team of prosecutors and Computer Crime and Intellectual Property Section lawyers assigned to the matter. Assistant U.S. Attorneys Jennifer Chang and Ann Marie Ursini are listed as counsel from the Northern District of Illinois, with Assistant Deputy Chief Adrienne L. Rose assisting for CCIPS. Those lawyers will handle pretrial matters, responses to discovery, and any motions the defense may file.
FBI Chicago’s top agent framed this action as part of broader efforts to protect American businesses from online attacks that cross borders and industries. “The responsibility of protecting our nation’s security and welfare extends beyond our borders, over international territories, and most critically, in the cyber universe,” said FBI SAC DePodesta. He added that international partnerships and cross-agency collaboration were central to identifying and charging a known Scattered Spider actor.
The case is being described as one piece of Operation Riptide, the FBI’s long-running campaign to disrupt cybercriminal infrastructure, money flows, and support networks. Last year alone, Americans reported more than $20 billion in losses attributed to cybercrime, a figure the government says represented a 26 percent increase over the prior year. Operation Riptide aims to sustain enforcement against the actors and systems that enable those losses.
A federal complaint is an accusation and not proof of guilt, and every defendant retains the right to a full and fair trial under the Constitution. The filing notes that the government bears the burden of proving guilt beyond a reasonable doubt, and it reiterates the presumption of innocence. As pretrial litigation unfolds, courts will weigh the evidence the government presents at hearings and, if the case goes to trial, before a jury.
Stokes Superseding Complaint 0 is available as the public court filing referenced in the indictment, showing the charges and the alleged factual narrative in detail. The document lays out the timeline, the alleged means of access, and the specific counts brought against the defendant, and it will be central to understanding the government’s case as it develops.
