Teen Arrested in Finland for Alleged Scattered Spider Hacking

Young man's hands on a keyboard

Peter Stokes, 19, has been seized by Finnish authorities on Commonwealth’s Front for Interpol’s Red Notice and subsequently extradited to the United States, the Department of Justice (DoJ) announced in a release today. Stokes holds dual U.S. and Estonian citizenship, and the arrest followed months of covert investigations involving the FBI in both Copenhagen and Chicago.


The DoJ says Stokes is alleged to have been a core member of the Scattered Spider hacking collective, a group linked worldwide to high‑profile ransomware campaigns. It is estimated that the syndicate has ordered more than $100 million in ransom payments, with the latest operation involving a luxury jewelry retailer that received a demand of roughly $8 million in cryptocurrency.


According to the court filing, the demand was never paid – the targeted firm allegedly "evicted" the hackers – but the company still endured approximately $2 million in losses from business disruption, investigations, and mitigation costs.


Stokes stands accused of computer intrusion, conspiracy, and fraud – charges the DoJ says stem from years of illicit activity carried out by the group. He appeared in federal court in Chicago on Tuesday, where a judge ordered him to remain in custody pending trial.


This arrest comes in the wake of two young men who pleaded guilty in August to crimes tied to a 2024 cyber‑attack on Transport for London (TfL). The UK National Crime Agency (NCA) identified the Scattered Spider team as the likely perpetrators of the so‑called “network intrusion” that compromised the personal data of about ten million customers.


The NCA also cited the group’s involvement in attacks on British retailers Co‑op and M&S last year, reinforcing the perception that the organization is composed mainly of young, native English speakers from the U.S. and U.K. and that it operates across national borders with ease.



The Finnish National Bureau of Investigation worked closely with the FBI to bring Stokes into custody, a collaboration that showcases growing international cooperation among law‑enforcement agencies when tackling transnational cyber‑crime. As part of the extradition process, Finland’s authorities upheld a key element of Interpol’s Red Notice system, highlighting the role of global alert mechanisms in preventing further malicious actions.


What does this mean for the broader cybersecurity landscape? With the arrest of an operative who could have been active for “years of work,” world powers are tightening their focus on ransomware collectives like Scattered Spider, which blur legal lines and exploit lax regulatory regimes in emerging markets. Governments and corporate defenders alike are urged to scrutinize supply chain partners, secure patched systems, and share intelligence across borders, as the next wave of cyber‑attacks may come from similarly young, highly skilled, transnational teams.