Federal prosecutors in Chicago have unsealed charges against a 19-year-old accused of belonging to Scattered Spider, one of the most prolific cybercriminal groups in recent years, tied to more than $100 million in ransom payments from U.S. companies.
Peter Stokes, a dual U.S.-Estonian citizen, faces conspiracy, computer intrusion, and fraud charges under a criminal complaint unsealed Tuesday in the Northern District of Illinois. He was arrested by Finnish authorities in April under an Interpol Red Notice and extradited to the U.S. last week. Stokes made his initial court appearance Tuesday in Chicago’s federal courthouse, where a judge ordered him held in custody pending trial.
Prosecutors allege Stokes was a member of Scattered Spider — also known by aliases including “Octo Tempest,” “UNC3944,” and “0ktapus” — a group tied to more than 100 network intrusions and over $100 million in ransom payments, plus additional millions in damages to victims. The group’s method, according to the complaint, typically involved tricking corporate help desks into resetting employee credentials, then using that access to steal or encrypt company data before demanding cryptocurrency payments.
The complaint centers on a May 2025 breach of an unnamed luxury jewelry retailer, referred to in filings as “Company F.” According to prosecutors, Stokes and other alleged co-conspirators posed as company employees, called the retailer’s IT help desk requesting password resets, and used that access to steal roughly 100 gigabytes of data. The hackers then demanded approximately $8 million in cryptocurrency. Security personnel at the company successfully expelled the intruders before any ransom was paid, though the retailer still lost an estimated $2 million from the disruption, investigation, and mitigation costs.
The complaint also ties Stokes to a March 2023 breach of an online communications platform — an intrusion prosecutors say occurred when he was 16 years old.
“The malicious attacks from Scattered Spider caused widespread disruption to businesses and organizations throughout the United States,” said Andrew Boutros, U.S. Attorney for the Northern District of Illinois. “These charges underscore our unwavering commitment to keeping pace with technologically savvy criminal actors and holding accountable those who seek to profit from cyber intrusions, including those located in foreign jurisdictions that harm American businesses and victims.”
The case is part of Operation Riptide, an ongoing FBI campaign targeting cybercrime networks, and follows a string of prosecutions against other alleged Scattered Spider members in recent years, including guilty pleas from members in Florida and the United Kingdom. Scattered Spider first drew national attention in 2023 after breaching the networks of casino operators Caesars Entertainment and MGM Resorts International.
Stokes is presumed innocent unless proven guilty in court. The investigation was led by the FBI’s Chicago Field Office, with assistance from the bureau’s Copenhagen attaché office.
Official/Primary sources
- DOJ Press Release: Alleged Member of Scattered Spider Arrested in Finland and Extradited — main DOJ announcement
- U.S. Attorney’s Office, Northern District of Illinois release — local prosecutorial statement with additional case detail
- CBS News Chicago coverage
- The Record (Recorded Future News) — detailed breakdown of the complaint
- Reuters wire coverage
- CISA advisory on Scattered Spider tactics — search “Scattered Spider” on site for their threat advisory page
- Microsoft Threat Intelligence on “Octo Tempest” — search their blog for Octo Tempest reporting
