CHICAGO — Peter Stokes, a dual U.S.-Estonian national, appeared in federal court in Chicago on Tuesday for charges including computer intrusion, conspiracy, and fraud. Stokes was ordered to remain in custody.

Stokes, 19, was extradited to the U.S. following an Interpol Red Notice. He had been arrested in Finland in April.

A complaint alleges that Stokes and co-conspirators demanded approximately $8 million in cryptocurrency from a luxury jewelry retailer last year after stealing its data. No ransom was paid, as the retailer reportedly evicted the hackers. The unnamed luxury jewelry company sustained losses of at least $2 million due to business disruption, investigation, and mitigation efforts related to the threat.

The U.S. Department of Justice stated that Scattered Spider, a group to which Stokes is allegedly connected, has been involved in hacks resulting in more than $100 million in ransom payments. Scattered Spider members are believed to be young, native English speakers from the U.S. and the UK. The UK National Crime Agency indicated that Scattered Spider was central to its investigation into cyberattacks targeting British retailers Co-op and M&S last year. The FBI worked on the operation in Copenhagen and Chicago, while Finland's National Bureau of Investigation also contributed to the effort.

Why It Matters

This case reflects international collaboration in addressing cybercrime, with law enforcement agencies from the U.S., Finland, and the UK participating in the operation. The alleged activities of Scattered Spider, including the reported demand of an $8 million cryptocurrency ransom and over $100 million in total ransoms, demonstrate the financial scope of cyber intrusions. The case also shows the financial impact on victim organizations, as seen with the luxury jewelry retailer's $2 million loss from business disruption.