Overview
- Peter Stokes, a 19-year-old dual U.S.-Estonia citizen, was extradited from Finland and made an initial federal court appearance in Chicago on July 1, 2026, where a criminal complaint was unsealed and he was ordered held in custody.
- The complaint charges Stokes with conspiracy, computer intrusion, and fraud for alleged membership in Scattered Spider, a group prosecutors say gains employee account access, exfiltrates or encrypts corporate data, and demands cryptocurrency ransoms.
- Prosecutors allege Stokes and co-conspirators breached a luxury jewelry retailer in May 2025, exfiltrated data, and demanded about $8 million in crypto; the retailer paid no ransom but suffered at least $2 million in business and mitigation costs.
- The Justice Department says Scattered Spider has been tied to more than 100 intrusions and over $100 million in ransom payments, and it says the case will be prosecuted by CCIPS and the U.S. Attorney’s Office for the Northern District of Illinois with FBI investigative help.
- Officials describe the action as part of Operation Riptide, a sustained effort to disrupt cybercriminal infrastructure and financial networks, a step that could lead to more cross-border arrests and give victims clearer legal paths to hold perpetrators to account.