Peter Stokes, a 19-year-old British teenager, has been arrested in Finland and extradited to the United States for his alleged role in the cyber hacking group Scattered Spider, which is linked to attacks on Transport for London (TfL) and Marks & Spencer (M&S). The US Department of Justice (DoJ) confirmed the arrest following an Interpol Red Notice.
Arrest and Charges
Stokes appeared in federal court in Chicago on Tuesday, charged with computer intrusion, conspiracy, and fraud. He was ordered to remain in custody. According to the DoJ, the Scattered Spider group has been involved in hacks that resulted in approximately £75 million in ransom payments. The group is also known as UNC3944, Octo Tempest, or Muddled Libra and is believed to include hackers as young as 16.
Alleged Cyber Attacks
The complaint alleges that Stokes and other co-conspirators breached the computer system of a luxury jewellery retailer in May 2025, exfiltrated company data, and demanded a ransom of roughly $8 million (£6 million) in cryptocurrency. The DoJ stated that no ransom was paid after the unnamed company “evicted” the hackers, but the jewellery company lost at least $2 million due to business disruption, investigation, and mitigation efforts.
Links to TfL Attack
The charges come after two men pleaded guilty to offences linked to the £39 million 2024 cyber-attack on Transport for London, which the UK’s National Crime Agency (NCA) believes was carried out by the Scattered Spider group. Stokes is alleged to be a member of this group, which has targeted high-profile organisations globally.
