Full Breakdown
US Extradites Alleged Scattered Spider Member After Finnish Arrest
7/3/2026, 5:29:42 AM
Arrest, Extradition and Charges
Peter Stokes, 19, was detained in Finland and extradited to the United States in June. He appeared in a Chicago federal court on June 30, where a judge ordered him held pending trial. Prosecutors allege he participated in a May 2025 breach of an unnamed luxury jewelry retailer, exfiltrated data and demanded about $8 million in cryptocurrency; the retailer repelled the attackers and reported $2 million in losses.
Scattered Spider & Operation Riptide
Scattered Spider—also known as Octo Tempest, UNC3944 and 0ktapus—is a loosely organized group operating in the United States and United Kingdom. The FBI links the group to over 100 intrusions, generating more than $100 million in ransom payments and millions in additional damages. Operation Riptide, an FBI campaign, targets the group’s infrastructure, financial channels and fraud schemes, and has warned about use of DragonForce ransomware against VMware ESXi servers.
Key Actors & Agencies
Key agencies include the U.S. Department of Justice, the U.S. Attorney’s Office for the Northern District of Illinois, and the FBI’s Copenhagen attaché office. Assistant Attorney General A. Tysen Duva and U.S. Attorney Andrew S. Boutros led the prosecution; FBI Special Agent-in-Charge Douglas S. DePodesta emphasized the international partnership.
Data & Statistics
- Over 100 intrusions linked to Scattered Spider, generating more than $100 million in ransom payments and millions in additional damages.
- The jewelry retailer reported $2 million in losses after repelling the attack.
- U.S. cybercrime losses hit $20 billion in 2025, a 26 % year-over-year increase.
Official Statements & Responses
Justice Department said charges stem from “years of investigative work” and reaffirmed a commitment to pursue cybercriminals globally. FBI emphasized international cooperation to dismantle the network. U.K. National Cyber Crime Unit warned the group’s tactics represent an increasing threat from cyber criminals based in the UK and other English-speaking countries.
Conflicting Reports & Gaps
The complaint estimates the retailer’s loss at “at least $2 million,” but independent verification is not provided. The allegations remain untested; Stokes is presumed innocent until convicted.
What’s Next
Operation Riptide will continue targeting Scattered Spider affiliates, with further prosecutions expected in the United States and Europe. Updated FBI/CISA advisories urge organizations to isolate backups, enforce phishing-resistant MFA and monitor for DragonForce ransomware.
Verbatim Quotes
- “The criminal complaint charges Peter Stokes with membership in Scattered Spider, a hacking group that has been involved in over 100 network intrusions, resulting in more than $100 million in ransom payments and millions more in damages to the victims,” — A. Tysen Duva, Assistant Attorney General, DOJ Criminal Division
- “Scattered Spider has repeatedly targeted US companies, extorting employees, inflicting millions of dollars in losses, and disrupting essential operations,” — Brett Leatherman, Assistant Director, FBI Cyber Division
- “The profile of offenders like Flowers and Jubair demonstrates the increasing threat from cyber criminals based in the UK and other English-speaking countries, epitomised by Scattered Spider,” — Paul Foster, Head, NCA National Cyber Crime Unit
- “The charges unsealed today are the result of years of work by the Criminal Division, the US Attorney’s Office for the Northern District of Illinois, and the FBI. We will continue to partner to ensure that cybercriminals cannot evade the reach of the United States.” — A. Tysen Duva, Assistant Attorney General, DOJ
