
A 19-year-old hacker tied to the Scattered Spider collective faces federal charges after a luxury retailer breach demanding $8 million in crypto. Two terabytes of data were seized at his arrest.
A 19-year-old dual US-Estonian national appeared in a Chicago federal courtroom on June 30, facing charges tied to a luxury retailer breach that demanded roughly $8 million in cryptocurrency.
Peter Stokes was arrested at Helsinki airport in April 2026 while trying to board a flight to Japan, according to federal prosecutors. Finnish authorities detained him, and he was extradited to the US. The charges include conspiracy to damage protected computers, cyber intrusion, and fraud.
Prosecutors said Stokes was a working member of Scattered Spider, a hacking collective known for social-engineering attacks. The group calls help desks, impersonates employees, and talks its way into corporate accounts. Targets have included retail, hospitality, financial services, and technology companies.
The centerpiece of the case is a May 2025 breach of a luxury jewelry retailer. The attackers demanded about $8 million in cryptocurrency. The company refused to pay. The retailer spent over $2 million recovering from the attack, restoring systems, and dealing with the fallout, the indictment said.
Two terabytes of data were seized from hard drives found on Stokes at the time of his arrest. Prosecutors connected him to at least four separate intrusions, allegedly beginning when he was 16 years old.
Scattered Spider, also tracked under the names Octo Tempest and UNC3944, has been linked to more than 100 unauthorized corporate intrusions. Ransom demands tied to those breaches exceeded $100 million in aggregate, prosecutors said.
Stokes is not the first Scattered Spider-linked defendant to face charges. Two other alleged members recently pleaded guilty to related charges in the United Kingdom, part of a coordinated, multi-jurisdictional push to dismantle the network. The group skewed unusually young, with members allegedly recruited in their mid-teens through online gaming communities and cybercrime forums.
Stokes's next court appearance is scheduled for July 15.
Prepared with AlphaScala research tooling and grounded in primary market data: live prices, fundamentals, SEC filings, hedge-fund holdings, and insider activity. Each story is checked against AlphaScala publishing rules before release. Educational coverage, not personalized advice.