Peter Stokes (Scattered Spider)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3qMEbJ…z7b5Summary
Peter Stokes, 19, a dual U.S.-Estonian national, was arrested in Finland in April 2026 on an Interpol Red Notice and extradited to the United States on July 1, 2026 to face federal charges in the Northern District of Illinois for alleged membership in the Scattered Spider cybercrime collective. Prosecutors allege Stokes participated in a May 2025 social-engineering breach of an unnamed luxury jewelry retailer in which attackers reset an employee's two-factor authentication credentials via the company help desk, stole data, and demanded roughly $8 million in cryptocurrency. All allegations against Stokes are pending trial and unproven in court; Scattered Spider as a network has been linked by U.S. authorities to more than 100 corporate intrusions and over $100 million in crypto-denominated ransom and extortion payments.
Connected Entities
1 entitiesTimeline(6 events)
May 2025
Alleged breach of an unnamed luxury jewelry retailer via help-desk social engineering; attackers allegedly demand roughly $8 million in cryptocurrency ransom (exact date within May 2025 as reported).
DecryptApril 2026
Peter Stokes allegedly arrested by Finnish authorities on an Interpol Red Notice, reportedly while attempting to board a flight to Japan (exact date within April 2026 as reported).
Cryptobriefing20 April 2026
Tyler Robert Buchanan ("Tylerb"), a separately charged alleged Scattered Spider member, pleads guilty to wire fraud conspiracy and aggravated identity theft.
The Register / Krebs on Security30 June 2026
Peter Stokes makes initial appearance in Chicago federal court and is ordered held pending trial.
DecryptJuly 2026
DOJ announces Stokes' extradition from Finland to the United States and unseals charges of conspiracy, computer intrusion, and fraud.
WTTW Chicago News / crypto.news16 July 2026
Owen Flowers and Thalha Jubair, alleged Scattered Spider members, sentenced to 5.5 years each at Woolwich Crown Court for the £29 million Transport for London hack.
The Hacker NewsDecision Log
- hash: Bs8i57zkcnTfYHjvPThhUuw1kPBFaVvNtakvwNkqfnYB
This investigation is cryptographically anchored to the Solana blockchain (1 event). 13 of 14 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 7/22/2026, 2:07:28 AM
last updated: 7/27/2026, 2:17:31 PM
3 viewsavoid.net — verified advice for a post-truth world