A 19-year-old man accused of affiliation with the criminal hacking collective known as "Scattered Spider" has been extradited from Finland to the United States to face federal charges in Illinois, the Justice Department said.
The defendant, identified as Peter Stokes, holds dual citizenship in the United States and Estonia. A criminal complaint unsealed on Tuesday charges him with conspiracy, computer intrusion and fraud. Finnish authorities arrested Stokes in April following the issuance of an Interpol Red Notice, and he was transferred to U.S. custody last week, the Justice Department said.
Stokes made an initial court appearance on Tuesday in federal court in Chicago, where a judge ordered that he remain detained pending further proceedings, according to the Justice Department statement.
In describing the activity attributed to the group, the Justice Department said Scattered Spider has been tied to more than 100 network intrusions. Those incidents have produced in excess of $100 million in ransom payments and have caused millions more in damages to victims, Assistant Attorney General A. Tysen Duva said in the Justice Department statement.
Authorities underscored the operational impact of the alleged campaign. "Scattered Spider has repeatedly targeted U.S. companies, extorting employees, inflicting millions of dollars in losses, and disrupting essential operations," said Assistant Director Brett Leatherman of the FBI's Cyber Division.
U.S. prosecutors previously announced criminal charges in 2024 against other individuals alleged to be members of Scattered Spider, a description officials have used to characterize a loose-knit community of hackers. Prosecutors say the group is suspected of breaking into dozens of U.S. companies to steal confidential information and cryptocurrency.
The group has been blamed for a series of unusually aggressive cybercrime sprees that targeted both multinational corporations and individual cryptocurrency investors. In September 2023, members of the group drew wide attention after breaching and locking networks at casino operators Caesars Entertainment and MGM Resorts International and demanding ransoms. Caesars paid about $15 million to restore its network, according to the account provided by investigators.
Prosecutors have alleged specific tactics used by defendants in related cases. They say Buchanan and other defendants conducted phishing campaigns that involved sending bogus but realistic mass text messages to employees' mobile phones. Those messages warned recipients that their accounts would be deactivated unless they clicked on a link that, prosecutors allege, covertly granted system access to the hackers.
The extradition and charging of Stokes adds to an ongoing series of prosecutions linked to Scattered Spider. Officials point to substantial ransom payments and operational disruption as part of the rationale for the federal cases now moving forward in the United States.
Legal steps now underway
- Criminal complaint unsealed on Tuesday charges Stokes with conspiracy, computer intrusion and fraud.
- Stokes was arrested in Finland in April after an Interpol Red Notice and extradited to the United States last week.
- An initial appearance was held in federal court in Chicago where Stokes was ordered to remain in custody.