Alleged Scattered Spider Hacker Extradited to US Following International Cybercrime Investigation
July 6, 2026: A 19-year-old man accused of being associated with the Scattered Spider cybercrime group has been extradited to the United States after being arrested by Finnish authorities at Helsinki Airport.
According to US authorities, Peter Stokes, a dual US-Estonian citizen, was detained in April while allegedly attempting to board a flight to Japan. The arrest was carried out under an Interpol Red Notice.
He was extradited to the United States in late June and appeared before a federal court in Chicago on June 30, where he was ordered to remain in custody pending trial.
Microsoft Data Reportedly Assisted the Investigation
According to court documents, investigators used technical information provided by Microsoft during the investigation.
Authorities said data linked to a Global Device Identifier (GDID), a unique identifier associated with a Windows installation, helped investigators connect a specific device to online activity relevant to the case.
The information reportedly included:
- Device activity timestamps
- IP address records
- Account-related information
- Technical usage logs
- Other digital evidence examined during the investigation
Investigators allege that the data helped establish connections between the device and the cyber incidents under investigation.
Charges Filed in the United States
US prosecutors have charged Stokes with several offenses, including:
- Conspiracy
- Unauthorized computer intrusion
- Fraud-related offenses
The allegations have not been proven in court, and the defendant is presumed innocent unless found guilty through the legal process.
Alleged Links to Scattered Spider
The US Department of Justice alleges that Stokes was connected to the cybercrime group known as Scattered Spider, which has also been tracked by cybersecurity researchers under several other names.
Authorities claim the group has been linked to numerous cyberattacks targeting businesses through social engineering techniques, including attempts to gain unauthorized access to corporate systems.
Investigation into 2025 Cyberattack
One of the cases cited by prosecutors involves an alleged cyberattack on a US luxury jewelry company in May 2025.
According to the criminal complaint, attackers allegedly contacted the company’s IT help desk while impersonating employees to obtain access to internal accounts.
The company reportedly detected the unauthorized activity, secured its systems, and did not pay the ransom demand. However, investigators say the incident resulted in significant financial losses related to system recovery and operational disruption.
International Cooperation
The investigation was led by the FBI’s Chicago Field Office with assistance from international law enforcement agencies, including authorities in Finland.
US officials said the accused remains in federal custody while awaiting further court proceedings.
