Overview
- Law enforcement arrested the 19‑year‑old in Helsinki while he was boarding a flight to Japan, which occurred in April 2026 and led to his extradition to the United States.
- Stokes made an initial federal court appearance in Chicago on June 30, 2026, and now faces counts including conspiracy, computer intrusion, and fraud.
- Court filings say Microsoft’s Global Device Identifier telemetry helped link a Windows‑installed device to online activity and locations used in the alleged intrusions.
- The unsealed complaint centers on a May 2025 attack on a U.S. luxury jewelry retailer that used fake help‑desk calls to reset credentials, exfiltrate data, demand about $8 million in crypto, and cause roughly $2 million in losses.
- The Justice Department frames the prosecution as part of Operation Riptide and the case raises questions for companies about telemetry use, evidence sharing, disclosure, liability, and incident‑response standards.