Scattered Spider suspect extradited over $8 million ransom scheme

A suspected Scattered Spider member has been extradited to the United States to face charges linked to cyberattacks against U.S. companies, including the breach of a luxury jewelry retailer that led to an $8 million cryptocurrency ransom demand after attackers stole company data.

The retailer’s security team removed the attackers from its network before any ransom was paid. The company still incurred at least $2 million in losses from business disruption, incident response, and recovery efforts.

Peter Stokes, 19, a dual U.S.-Estonian citizen, has been charged with conspiracy, computer intrusion, and fraud.

Finnish authorities arrested Stokes in April following an Interpol Red Notice. He was extradited to the United States last week, appeared in federal court in Chicago on Tuesday, and was ordered to remain in custody.

“The criminal complaint charges Peter Stokes with membership in Scattered Spider, a hacking group that has been involved in over 100 network intrusions, resulting in more than $100 million in ransom payments and millions more in damages to the victims,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.

According to the complaint, Scattered Spider, also known as Octo Tempest, UNC3944, and 0ktapus, is a cybercrime group that targeted U.S. companies by tricking employees into giving attackers access to their accounts. The group then stole or encrypted company data and demanded cryptocurrency payments in exchange for restoring access or preventing the release of the stolen data.