Story perspectives

Finland Extradites 19-Year-Old for $8M Jewelry Hack

7/3/2026

Summary

Stokes Extradited

Peter Stokes, a 19-year-old U.S. citizen, was extradited from Finland and appeared in Chicago federal court, accused of helping the Scattered Spider group breach a jewelry retailer’s computers in May 2025 and demand $8 million in cryptocurrency.
The retailer’s team stopped the attackers before any ransom was paid, resulting in $2 million in losses.
Stokes remains detained as part of Operation Riptide, which reported $20 billion in cybercrime losses last year.

Summary

Scattered Spider Strikes

Scattered Spider claimed attacks on UK retailers Marks & Spencer and the Cooperative Group, and on U.S. MGM Resorts.
Assistant director Brett Leatherman said the group re-emerges by teaming with ShinyHunters and LAPSUS$.
The FBI’s cyber division reported repeated targeting of U.S. companies, employee extortion, and millions of dollars in losses.
Law enforcement officials stressed strong domestic and international partnerships to identify, disrupt, and hold the cybercriminals accountable.

Summary

Jubair Flowers Guilty

Thalha Jubair, 20, and Owen Flowers, 18, pleaded guilty in June to a cyberattack on Transport for London (TfL).
The attack ran from 31 August to 3 September 2024 and forced all 28,000 TfL staff to reset passwords.
The National Crime Agency estimated £29 million in losses and recovery costs.
Paul Foster, head of the NCA’s National Cyber Crime Unit, said the case shows a rising UK-based cyber-crime threat exemplified by Scattered Spider.

Summary

Scattered Spider Crackdown

The advisory urges stricter identity verification before help-desk password resets and sign-in keys.
Mandiant warns that after the 2025 arrests, crews are copying Scattered Spider’s tactics.
Investigators say 2-terabyte hard drives seized from Stokes in Helsinki may trace more members.
The crackdown now names suspects, as shown by Tyler Buchanan’s guilty plea in Scotland.
It notes intruders often stay in chat tools and join incident-response calls to monitor investigators.

History

Historical Context

June 2010 researchers uncovered Stuxnet, a worm that infected over 200,000 computers and destroyed about 1,000 Iranian Natanz centrifuges by targeting Siemens PLCs, an attack linked to U.S. and Israeli intelligence. The 2024-2025 Scattered Spider raids, pursued by the FBI and the UK National Crime Agency, reuse similar zero-day tactics, spurring coordinated international law-enforcement.

1 of 5

Stokes Extradited

Peter Stokes, a 19-year-old U.S. citizen, was extradited from Finland and appeared in Chicago federal court, accused of helping the Scattered Spider group breach a jewelry retailer’s computers in May 2025 and demand $8 million in cryptocurrency.
The retailer’s team stopped the attackers before any ransom was paid, resulting in $2 million in losses.
Stokes remains detained as part of Operation Riptide, which reported $20 billion in cybercrime losses last year.

1 / 5