A 19-year-old dual US-Estonian citizen has been extradited to the United States on charges he was part of the Scattered Spider hacking crew. Peter Stokes — handles “Bouquet,” “Spencer,” and “Jordan” — was arrested in Finland on April 10 while trying to board a flight to Japan.
The charges are serious. Court documents tie Stokes to at least four Scattered Spider breaches, starting when he was 16 years old with a March 2023 hack of an online communications platform. The group demanded millions in ransoms from victims.
One 2025 hit on a luxury retailer: the hackers called the IT helpdesk, pretended to be employees, reset credentials, and grabbed admin access. They demanded $8 million, claiming 100GB of stolen data. The company didn’t pay. Still cost them over $2 million in disruption and cleanup.
Stokes now faces fraud, conspiracy, and computer intrusion charges. He appeared in federal court in Chicago Tuesday and remains in custody.
The DOJ says Scattered Spider is linked to over 100 network intrusions, over $100 million in ransom payments, and millions more in damages. The group — also tracked as 0ktapus, Octo Tempest, and UNC3944 — emerged in 2022, mostly made up of teenagers and young adults from the US and UK.
Their playbook: social engineering, MFA bombing, SMS phishing. They’ve hit Caesars, MGM, Riot Games, DoorDash, Reddit, Twilio, and many more. This arrest is one piece of a much bigger puzzle.
