Law enforcement caught up with Peter Stokes at Helsinki airport in April 2026. He was reportedly trying to board a flight to Japan. Instead, he ended up in Finnish custody, and on June 30, 2026, he appeared in a Chicago federal courtroom facing charges that read like a greatest-hits list of cybercrime: conspiracy to damage protected computers, cyber intrusion, and fraud.
Stokes is 19 years old. He holds dual US-Estonian citizenship. And according to federal prosecutors, he was a working member of Scattered Spider, one of the most prolific and disruptive hacking collectives active today.
The $8 million ask that went unanswered
The centerpiece of the charges against Stokes involves a May 2025 breach of a luxury jewelry retailer. The attackers demanded roughly $8 million in cryptocurrency as ransom. The company said no.
That refusal came at a cost. The retailer spent over $2 million recovering from the attack, restoring systems, and dealing with the fallout.
