Alleged member of hacking group 'Scattered Spider' arrested in Finland

Scattered Spider, also known as “Octo Tempest,” “UNC3944,” or “0ktapus,” is a group of criminal cyber actors that attempts to extort ransoms from companies. An alleged member of the "Scattered Spider" hacking group has been arrested and extradited to the United States, US authorities announced on Wednesday. Peter Stokes, 19, was arrested in Finland in April and faces charges of conspiracy, computer intrusion, and fraud, the Justice Department said in a press release. Stokes, a dual US-Estonian national, appeared at a federal court on Tuesday in Chicago, where he was ordered to remain in custody. A criminal complaint alleged that Stokes, along with coconspirators, targeted a luxury jewelry retailer’s computer system in May 2025, exfiltrating data from the firm and making a ransom demand of around $8 million in cryptocurrency. No ransom was paid after the company's security personnel were able to remove the threat actors from its computer network. But the retailer is said to have made a loss of at least $2 million due to "business disruption, investigation, and mitigation of the threat". Scattered Spider, which is also known as “Octo Tempest,” “UNC3944,” or “0ktapus,” is a group of criminal cyber actors that attempts to extort ransoms from companies. The FBI says the network has been linked to more than 100 network intrusions, leading to more than $100 million in ransom payments and millions of dollars in damages. The group has been linked to high-profile cyberattacks across the globe, including in the US and the United Kingdom. In June, two men pleaded guilty in the UK to carrying out a cyberattack on Transport for London, a government body responsible for London's travel network. Thalha Jubair, 20, and Owen Flowers, 18, are said to have breached TfL's network between 31 August and 3 September 2024. The UK's National Crime Agency said the pair forced all 28,000 TfL employees to attend a TfL office for a password reset, with the organisation also reporting £29 million "in loss and recovery costs". "The profile of offenders like Flowers and Jubair demonstrates the increasing threat from cyber criminals based in the UK and other English-speaking countries, epitomised by Scattered Spider," Paul Foster, the head of the NCA’s National Cyber Crime Unit, said.