Prosecutors say teen hacker demanded $8M in cryptocurrency from jeweler
Peter Stokes was arrested by Finnish authorities in April pursuant to an Interpol Red Notice and extradited to the United States last week, according to the Justice Department. He made an initial appearance Tuesday in federal court in Chicago and was ordered to remain detained.
The charges against Stokes, contained in a superseding criminal complaint unsealed Tuesday, stem from his alleged membership in Scattered Spider, a hacking group the Justice Department said has been involved in over 100 network intrusions resulting in more than $100 million in ransom payments and millions more in damages.
The complaint alleges that Stokes and co-conspirators made a ransom demand of roughly $8 million in cryptocurrency to a luxury jewelry retailer after stealing its data last year, prosecutors said. No ransom was paid after the company “evicted” the hackers from its systems, the DOJ said, but the business sustained at least $2 million in losses from business disruption, investigation and mitigation of the threat.
The FBI, working from offices in Copenhagen and Chicago, and Finland’s National Bureau of Investigation jointly worked the operation leading to Stokes’ arrest, the DOJ said. The Justice Department said the charges came after “years of work” investigating the group.
The case also intersects with UK law enforcement investigations. Two men pleaded guilty last month to offenses connected to the 2024 Transport for London cyberattack, which the National Crime Agency said it believed was carried out by Scattered Spider. The TfL attack exposed data belonging to roughly 10 million people.
The NCA told the BBC that Scattered Spider was also a key part of its investigations into cyber attacks on British retailers Co-op and M&S last year. According to the NCA, the group’s members are thought to be young, native English speakers from the US and UK.