- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,791
His hacking career began at the age of 16 and ended at Helsinki Airport.
Peter Stokes, 19, was detained at Helsinki Airport . US authorities believe he is a member of Scattered Spider, one of the most notorious hacker groups that relied on convincing calls to corporate support services rather than sophisticated hacks. Investigators believe the Chicago teenager participated in attacks on major companies before reaching adulthood, and now faces extradition to the US.
The Chicago federal prosecutor's office unsealed the indictment against Stokes on April 28, 2026. The case had been filed in December 2025, but the materials remained sealed for several months. Stokes, a US-Estonian citizen, was detained on April 10 at Helsinki-Vantaa Airport when, according to authorities, he was attempting to fly to Japan. Finnish police seized two 2-terabyte hard drives during the arrest.
Investigators link Stokes to the nickname "Bouquet" and at least four corporate attacks . According to prosecutors, he committed the first of these at age 16. This involved hacking an online communications platform in March 2023, after which the victim company paid a ransom of several million dollars.
The most significant incident in the case concerns a May 2025 attack on an unnamed luxury goods retailer with a multi-billion dollar turnover. According to the prosecution, the Scattered Spider members called the company's support team, impersonated employees, and demanded that credentials be reset. Having gained access to work accounts, they were able to escalate privileges to administrator levels.
After the infiltration, the attackers claimed to have stolen 100 GB of data and demanded $8 million. The company's name was not disclosed in the documents, but the described scheme is consistent with the methods Scattered Spider used against large organizations in the hospitality, telecommunications, and retail sectors.
Stokes remains in custody in Finland. The United States is seeking his extradition, after which the case is expected to be transferred to the federal court for the Northern District of Illinois. The date for the first hearing in the United States has not yet been set.
Stokes' case fits into a broader campaign by the FBI and the US Department of Justice against Scattered Spider. Over the past two years, US authorities have indicted several alleged members of the group. Investigations reveal that Scattered Spider developed a network of young people, often associated with gaming communities, Discord servers, and forums, where reputations could quickly be parlayed into criminal profits.
Peter Stokes, 19, was detained at Helsinki Airport . US authorities believe he is a member of Scattered Spider, one of the most notorious hacker groups that relied on convincing calls to corporate support services rather than sophisticated hacks. Investigators believe the Chicago teenager participated in attacks on major companies before reaching adulthood, and now faces extradition to the US.
The Chicago federal prosecutor's office unsealed the indictment against Stokes on April 28, 2026. The case had been filed in December 2025, but the materials remained sealed for several months. Stokes, a US-Estonian citizen, was detained on April 10 at Helsinki-Vantaa Airport when, according to authorities, he was attempting to fly to Japan. Finnish police seized two 2-terabyte hard drives during the arrest.
Investigators link Stokes to the nickname "Bouquet" and at least four corporate attacks . According to prosecutors, he committed the first of these at age 16. This involved hacking an online communications platform in March 2023, after which the victim company paid a ransom of several million dollars.
The most significant incident in the case concerns a May 2025 attack on an unnamed luxury goods retailer with a multi-billion dollar turnover. According to the prosecution, the Scattered Spider members called the company's support team, impersonated employees, and demanded that credentials be reset. Having gained access to work accounts, they were able to escalate privileges to administrator levels.
After the infiltration, the attackers claimed to have stolen 100 GB of data and demanded $8 million. The company's name was not disclosed in the documents, but the described scheme is consistent with the methods Scattered Spider used against large organizations in the hospitality, telecommunications, and retail sectors.
Stokes remains in custody in Finland. The United States is seeking his extradition, after which the case is expected to be transferred to the federal court for the Northern District of Illinois. The date for the first hearing in the United States has not yet been set.
Stokes' case fits into a broader campaign by the FBI and the US Department of Justice against Scattered Spider. Over the past two years, US authorities have indicted several alleged members of the group. Investigations reveal that Scattered Spider developed a network of young people, often associated with gaming communities, Discord servers, and forums, where reputations could quickly be parlayed into criminal profits.
