Alleged Scattered Spider Member Extradited to U.S.

Peter Stokes, 19, who uses the alias ‘Bouquet’, was extradited from Finland to the United States after his arrest in April while boarding a flight to Japan. U.S. authorities transferred him following an indictment that charges him with conspiracy, computer intrusion and fraud.

The indictment alleges Stokes and co-conspirators carried out a May 2025 intrusion into a luxury jewelry retailer’s computer systems, stole data and demanded an $8 million ransom in cryptocurrency. The retailer removed the intruders from its network and did not pay. Prosecutors say the attack and the subsequent investigation and mitigation caused at least $2 million in losses from business disruption.

Prosecutors describe the charges as part of a broader set of operations attributed to the hacking group Scattered Spider. Authorities track the group under multiple names, including 0ktapus, Muddled Libra, Octo Tempest, Starfraud, Scatter Swine and UNC3944. Officials estimate the network targeted at least 100 organizations and received more than $100 million in ransom payments.

Scattered Spider drew attention for a 2025 campaign that exploited Salesforce systems and for a 2022 campaign known as 0ktapus that affected more than 130 organizations. Investigations have linked the group to intrusions in the retail, insurance and aviation sectors.

U.S. and international authorities have charged, arrested and convicted several people alleged to be members of the group. In April, U.K. national Tyler Robert Buchanan pleaded guilty in the United States for his role in Scattered Spider operations. The group announced its retirement in September of last year.

Officials say the extradition and indictment involved cooperation between European authorities and U.S. prosecutors. Prosecutors have not released additional evidence beyond the indictment; upcoming court hearings will determine the next steps in the case.