U.S. Charges 19-Year-Old Allegedly Tied to Scattered Spider After Extradition

The U.S. Department of Justice said Peter Stokes, a 19-year-old dual U.S.-U.K. citizen, has been extradited to the United States to face charges connected to the hacking group known as Scattered Spider, according to CoinDesk. Prosecutors allege Stokes participated in a May 2025 cyberattack targeting a U.S. luxury jewelry retailer. The complaint says the attackers posed as company employees and placed phishing calls to the technical support desk to request password resets, allowing them to access multiple employee accounts, including ones with elevated privileges. After gaining access, the group allegedly stole company data and demanded about $8 million in cryptocurrency. The retailer ultimately removed the intruders from its internal network without paying, the DOJ said, but still incurred losses of at least $2 million tied to business disruption, investigation, and incident response. The DOJ described Scattered Spider as also operating under names including Octo Tempest, UNC3944 and 0ktapus. Authorities link the group to more than 100 intrusions and say total ransom payments tied to its activity exceed $100 million. Prosecutors said the group has relied on social engineering, account takeovers, data theft and crypto-ransomware tactics, largely aimed at corporate targets. In 2024, U.S. prosecutors charged five additional individuals allegedly linked to the same organization in cases involving phishing, SIM swapping and at least $11 million in stolen cryptocurrency. Officials said those cases underscore that the group's activity has extended beyond corporate data theft to direct theft of digital assets, including attacks involving victims connected to crypto trading platforms. The case comes as ransomware economics shift. Chainalysis has reported that ransomware payouts fell 35% in 2024, citing law enforcement actions, sanctions and improved recovery capabilities among companies. Its 2026 Ransomware Report adds that in 2025, ransomware-linked groups still received more than $8.2 billion in on-chain payments, down about 8% from 2024, even as the number of claimed attacks rose 50%—suggesting payment volumes declined but pressure on victims persisted. The DOJ also pointed to the importance of on-chain tracking in cybercrime investigations, where agencies combine wallet addresses, exchange records and fund flows to connect crypto transactions to real-world identities. Officials said the case is part of the FBI's "Operation Riptide," targeting cybercriminals, their infrastructure and associated financial networks, and warned that suspects abroad can still face U.S. prosecution if attacks impact American companies or their customers.