Scattered Spider suspect extradited to the US

The US Department of Justice announced (July 1, 2026): Peter Stokes, 19, a dual US-Estonian citizen and alleged member of the Scattered Spider hacking group, was arrested in Finland and extradited to the US to face federal charges in the Northern District of Illinois.

Key points

• Charges: conspiracy, computer intrusion and fraud. Stokes was arrested in April by Finnish authorities under an Interpol Red Notice, appeared in federal court in Chicago on Tuesday and remains in custody.
• Per DOJ, Scattered Spider (aka Octo Tempest, UNC3944, 0ktapus) is tied to over 100 network intrusions and more than $100M in ransom payments — its core playbook: hijacking employee accounts via social engineering, then encrypting or exfiltrating data and extorting crypto.
• Case highlighted in the complaint: breaching a luxury jewelry retailer and demanding ~$8M (May 2025); the retailer's security team evicted the attackers and paid nothing, yet still lost at least $2M to disruption and remediation.
• The case is part of Operation Riptide, the FBI's campaign against cybercrime actors, infrastructure and financial networks.

Lesson for security teams: Scattered Spider attacks people (helpdesk flows, MFA fatigue), not 0-days — internal identity-verification procedures remain the most important defense. DOJ notes a complaint is an allegation; defendants are presumed innocent.