Dual-Citizen Teen Extradited for Scattered Spider Luxury Retailer Breach Using MFA Reset Phishing

The unsealed Northern District of Illinois complaint details Stokes, operating under aliases Bouquet, Spencer and Jordan, compromising three accounts at Company F via Google Voice calls to reset credentials on IT admin mailboxes. Within hours the actors escalated privileges, deployed ngrok for persistence, and demanded $8 million in crypto; the firm incurred roughly $2 million in disruption costs without paying. FBI attributes over 100 intrusions and $100 million in ransoms to the loose English-speaking collective. Stokes' March 2023 access to Company H, an online communications platform, and prior arrests of young affiliates in casino and transport agency cases reveal a consistent recruitment vector: English-speaking teens and early-20s dual nationals drawn into SMS phishing and vishing crews. Court filings show minimal operational tradecraft yet rapid privilege escalation, indicating the group prioritizes speed and social engineering over custom malware. Extradition from Finland after an Interpol Red Notice highlights enforcement friction: dual citizenship and European arrest locations complicate rapid takedowns while US companies continue reporting similar help-desk compromises. The pattern suggests Scattered Spider cells rotate young operators to reduce attribution risk and exploit jurisdictional gaps. Next steps include unsealing additional indictments against US-Estonian or UK-based minors and possible civil actions against ngrok misuse vectors; prosecutors are expected to seek cooperation from arrested affiliates to map remaining cells before they rebrand.