Peter Stokes, a 19-year-old dual citizen of the US and Estonia, landed in a Chicago federal courtroom on June 30, 2026, after being extradited from Finland. He was promptly ordered detained.
The Department of Justice unsealed charges against Stokes on July 1, accusing him of involvement with Scattered Spider, a loosely organized cybercrime collective that has become one of the most prolific hacking groups in recent memory. The specific charge centers on a May 2025 breach of an unnamed luxury jewelry retailer, during which attackers stole data and demanded $8 million in cryptocurrency.
The jeweler didn’t pay. It still suffered at least $2 million in damages from the disruption, investigation, and cleanup.
A teenager with two terabytes
Stokes was arrested in Finland in April 2026 under an Interpol Red Notice. Finnish law enforcement seized two 2TB hard drives from him at Helsinki airport, a detail that gives some sense of the scale of data potentially tied to these operations.
