US Extradites Dual US-Estonian Citizen Peter Stokes, 19, from Finland on Scattered Spider Charges

Stokes, online handle Bouquet, faces charges linked to a May 2025 luxury jewelry retailer breach where data was copied and an $8 million crypto ransom demanded. The victim spent over $2 million on remediation after refusing payment. Court filings detail help-desk social engineering that bypassed MFA, consistent with Scattered Spider tradecraft documented in Mandiant and CrowdStrike reporting since the 2023 MGM incident. Seized drives represent the operational core: similar seizures in prior cases produced chat logs, wallet addresses, and co-conspirator handles that accelerated UK and US arrests. Tyler Buchanan’s April 2026 guilty plea and Noah Urban’s 2025 sentencing both stemmed from comparable device and financial trail evidence. The pattern shows law enforcement shifting from sector-wide disruption claims to targeted device exploitation. Scattered Spider’s loose structure—English-speaking adolescents across multiple jurisdictions—complicates traditional group attribution yet enables rapid playbook replication by successors. Help-desk identity verification gaps remain the persistent vector despite repeated public advisories. Cross-border extraditions now function as the primary constraint rather than technical defenses.