Audit log

Every state-changing event for Peter Stokes (Scattered Spider): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-07-22 02:07:54Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   Bs8i57zkcnTf…wNkqfnYBcopysha256 → base58

   verifying row…

   canonical bytes (13686 B) ▸

   {"actor":"system:backfill","investigation_id":"1648ffcc-c77b-4141-9146-2cc62e59765b","kind":"publish","page_slug":"peter-stokes-scattered-spider","published_at":"2026-07-22T02:07:54.192Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Peter Stokes (Scattered Spider)","sections":[{"content":"Federal prosecutors in the Northern District of Illinois allege that Peter Stokes and unnamed co-conspirators breached the computer systems of a luxury jewelry retailer in May 2025. According to the allegations, the intruders called the retailer's IT help desk, impersonated an employee, and convinced staff to reset two-factor authentication credentials, granting the attackers access to internal systems. The group allegedly stole company data and demanded approximately $8 million in cryptocurrency as ransom. The retailer's security team reportedly evicted the intruders and did not pay the ransom, but the company is alleged to have incurred at least $2 million in losses from business disruption, investigation, and remediation. Stokes was charged with conspiracy, computer intrusion, and fraud, and made an initial appearance in Chicago federal court on June 30, 2026, where he was ordered held pending trial. These are allegations only; Stokes has not been convicted, and the charges have not been proven in court.","heading":"Criminal Charges — Jewelry Retailer Crypto Ransom Scheme","severity":"critical","sources":[{"credibility":2,"name":"U.S. charges teen Scattered Spider suspect in crypto ransom scheme (crypto.news)","type":"news_article","url":"https://crypto.news/u-s-charges-teen-scattered-spider-suspect-in-crypto-ransom-scheme/"},{"credibility":2,"name":"Scattered Spider Suspect Extradited to US Over $8M Crypto Ransom Demand (Decrypt)","type":"news_article","url":"https://decrypt.co/372665/scattered-spider-suspect-extradited-to-us-over-8m-crypto-ransom-demand"},{"credibility":2,"name":"19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges (The Hacker News)","type":"news_article","url":"https://thehackernews.com/2026/07/19-year-old-scattered-spider-suspect.html"}]},{"content":"Stokes was reportedly arrested by Finnish authorities in April 2026 pursuant to an Interpol Red Notice, allegedly while attempting to board a flight to Japan at Helsinki airport. He was extradited to the United States and arrived to face charges in the Northern District of Illinois, with his initial federal court appearance in Chicago occurring on June 30, 2026, and extradition reported as finalized around July 1, 2026. The Department of Justice announced the arrest and extradition through press releases from its Office of Public Affairs and the U.S. Attorney's Office for the Northern District of Illinois.","heading":"Arrest and Extradition","severity":"high","sources":[{"credibility":2,"name":"Peter Stokes extradited to US over $8M crypto ransom scheme tied to Scattered Spider (Cryptobriefing)","type":"news_article","url":"https://cryptobriefing.com/peter-stokes-extradited-scattered-spider-crypto-ransom/"},{"credibility":1,"name":"Alleged cybercriminal accused of hacking, demanding ransoms arrested in Finland, extradited to Chicago (CBS Chicago)","type":"news_article","url":"https://www.cbsnews.com/chicago/news/alleged-cybercriminal-accused-hacking-arrested-finland-extradited-chicago/"},{"credibility":1,"name":"Alleged Member of Criminal Cyber Hacking Group \"Scattered Spider\" Arrested in Finland and Extradited to the United States (DOJ Office of Public Affairs, listing)","type":"regulatory","url":"https://www.justice.gov/opa/pr/alleged-member-criminal-cyber-hacking-group-scattered-spider-arrested-finland-and-extradited"}]},{"content":"Scattered Spider, also tracked by security researchers under the aliases Octo Tempest, UNC3944, and 0ktapus, and associated with the broader loose-knit online community known as \"The Com,\" is described by U.S. authorities as a prolific social-engineering-focused hacking collective. The group is alleged to specialize in phone-based social engineering against corporate IT help desks to gain account access, followed by data theft, ransomware deployment, and extortion demands typically denominated in cryptocurrency. U.S. authorities have linked the network to more than 100 corporate network intrusions and over $100 million in aggregate ransom and extortion payments. Members are reported to skew young, with several defendants in their late teens and early twenties.","heading":"Scattered Spider Network — Scope of Alleged Activity","severity":"critical","sources":[{"credibility":2,"name":"US DOJ Charges 19-Year-Old Tied to $100 Million Scattered Spider Crew (Yahoo News)","type":"news_article","url":"https://www.yahoo.com/news/us/articles/us-doj-charges-19-old-123153866.html"},{"credibility":2,"name":"DOJ charges 19-year-old with ties to Scattered Spider hacking group (Washington Times)","type":"news_article","url":"https://www.washingtontimes.com/news/2026/jul/1/doj-charges-19-year-old-ties-scattered-spider-hacking-group/"}]},{"content":"Stokes' case follows a pattern of U.S. and UK law enforcement action against other alleged Scattered Spider participants. Tyler Robert Buchanan, a 24-year-old British national known online as \"Tylerb,\" pleaded guilty in April 2026 to wire fraud conspiracy and aggravated identity theft tied to a 2022 SMS phishing campaign the group used to harvest employee credentials, later allegedly used to steal at least $8 million in cryptocurrency from U.S. victims; Buchanan's sentencing was reported as scheduled for August 2026. Noah Michael Urban, a Florida-based alleged member, was previously sentenced to 10 years in federal prison and ordered to pay approximately $13 million in restitution after pleading guilty to wire fraud and conspiracy charges. Separately, in the UK, Owen Flowers (18) and Thalha Jubair (20) were each sentenced to five and a half years in prison at Woolwich Crown Court on July 16, 2026, for a hack of Transport for London that authorities assessed caused approximately £29 million in combined losses and recovery costs; Flowers additionally admitted involvement in attacks on U.S. healthcare organizations SSM Health and Sutter Health. Jubair separately faces U.S. charges alleging involvement in roughly 120 network intrusions and $115 million in ransom proceeds. None of these related cases directly establishes Stokes' guilt, but they are cited by prosecutors and press coverage as part of the same alleged criminal network.","heading":"Related Prosecutions of Alleged Scattered Spider Members","severity":"high","sources":[{"credibility":2,"name":"'Scattered Spider' Member 'Tylerb' Pleads Guilty (Krebs on Security)","type":"news_article","url":"https://krebsonsecurity.com/2026/04/scattered-spider-member-tylerb-pleads-guilty/"},{"credibility":2,"name":"British hacker tied to Scattered Spider campaign pleads guilty in $8M scheme (The Record from Recorded Future News)","type":"news_article","url":"https://therecord.media/hacker-scattered-spider-guilty-plea"},{"credibility":2,"name":"Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack (The Hacker News)","type":"news_article","url":"https://thehackernews.com/2026/07/two-scattered-spider-hackers-get-55.html"}]}],"sources_used":[{"credibility":2,"name":"U.S. charges teen Scattered Spider suspect in crypto ransom scheme (crypto.news)","type":"news_article","url":"https://crypto.news/u-s-charges-teen-scattered-spider-suspect-in-crypto-ransom-scheme/"},{"credibility":2,"name":"Scattered Spider Suspect Extradited to US Over $8M Crypto Ransom Demand (Decrypt)","type":"news_article","url":"https://decrypt.co/372665/scattered-spider-suspect-extradited-to-us-over-8m-crypto-ransom-demand"},{"credibility":2,"name":"Two Scattered Spider Hackers Get 5.5 Years Each for £29 Million TfL Hack (The Hacker News)","type":"news_article","url":"https://thehackernews.com/2026/07/two-scattered-spider-hackers-get-55.html"},{"credibility":2,"name":"19-Year-Old Scattered Spider Suspect Extradited to Face U.S. Hacking Charges (The Hacker News)","type":"news_article","url":"https://thehackernews.com/2026/07/19-year-old-scattered-spider-suspect.html"},{"credibility":2,"name":"Peter Stokes extradited to US over $8M crypto ransom scheme tied to Scattered Spider (Cryptobriefing)","type":"news_article","url":"https://cryptobriefing.com/peter-stokes-extradited-scattered-spider-crypto-ransom/"},{"credibility":1,"name":"Alleged cybercriminal accused of hacking, demanding ransoms arrested in Finland, extradited to Chicago (CBS Chicago)","type":"news_article","url":"https://www.cbsnews.com/chicago/news/alleged-cybercriminal-accused-hacking-arrested-finland-extradited-chicago/"},{"credibility":1,"name":"Feds Accuse Teen of Conspiracy, Fraud in Connection to 'Scattered Spider' Criminal Cyber Hacking Group (WTTW Chicago News)","type":"news_article","url":"https://news.wttw.com/2026/07/01/feds-accuse-teen-conspiracy-fraud-connection-scattered-spider-criminal-cyber-hacking"},{"credibility":1,"name":"Alleged Member of Criminal Cyber Hacking Group \"Scattered Spider\" Arrested in Finland and Extradited to the United States (DOJ Office of Public Affairs)","type":"regulatory","url":"https://www.justice.gov/opa/pr/alleged-member-criminal-cyber-hacking-group-scattered-spider-arrested-finland-and-extradited"},{"credibility":1,"name":"Alleged Member of Criminal Cyber Hacking Group \"Scattered Spider\" Arrested in Finland and Extradited to United States (DOJ, Northern District of Illinois)","type":"regulatory","url":"https://www.justice.gov/usao-ndil/pr/alleged-member-criminal-cyber-hacking-group-scattered-spider-arrested-finland-and"},{"credibility":2,"name":"US DOJ Charges 19-Year-Old Tied to $100 Million Scattered Spider Crew (Yahoo News)","type":"news_article","url":"https://www.yahoo.com/news/us/articles/us-doj-charges-19-old-123153866.html"},{"credibility":2,"name":"DOJ charges 19-year-old with ties to Scattered Spider hacking group (Washington Times)","type":"news_article","url":"https://www.washingtontimes.com/news/2026/jul/1/doj-charges-19-year-old-ties-scattered-spider-hacking-group/"},{"credibility":2,"name":"'Scattered Spider' Member 'Tylerb' Pleads Guilty (Krebs on Security)","type":"news_article","url":"https://krebsonsecurity.com/2026/04/scattered-spider-member-tylerb-pleads-guilty/"},{"credibility":2,"name":"British hacker tied to Scattered Spider campaign pleads guilty in $8M scheme (The Record from Recorded Future News)","type":"news_article","url":"https://therecord.media/hacker-scattered-spider-guilty-plea"},{"credibility":2,"name":"US gets second Scattered Spider-linked guilty plea (The Register)","type":"news_article","url":"https://www.theregister.com/security/2026/04/20/us-gets-second-scattered-spider-linked-guilty-plea/5220131"}],"summary":"Peter Stokes, 19, a dual U.S.-Estonian national, was arrested in Finland in April 2026 on an Interpol Red Notice and extradited to the United States on July 1, 2026 to face federal charges in the Northern District of Illinois for alleged membership in the Scattered Spider cybercrime collective. Prosecutors allege Stokes participated in a May 2025 social-engineering breach of an unnamed luxury jewelry retailer in which attackers reset an employee's two-factor authentication credentials via the company help desk, stole data, and demanded roughly $8 million in cryptocurrency. All allegations against Stokes are pending trial and unproven in court; Scattered Spider as a network has been linked by U.S. authorities to more than 100 corporate intrusions and over $100 million in crypto-denominated ransom and extortion payments.","timeline":[{"date":"2025-05-01","event":"Alleged breach of an unnamed luxury jewelry retailer via help-desk social engineering; attackers allegedly demand roughly $8 million in cryptocurrency ransom (exact date within May 2025 as reported).","source":"Decrypt","source_url":"https://decrypt.co/372665/scattered-spider-suspect-extradited-to-us-over-8m-crypto-ransom-demand"},{"date":"2026-04-01","event":"Peter Stokes allegedly arrested by Finnish authorities on an Interpol Red Notice, reportedly while attempting to board a flight to Japan (exact date within April 2026 as reported).","source":"Cryptobriefing","source_url":"https://cryptobriefing.com/peter-stokes-extradited-scattered-spider-crypto-ransom/"},{"date":"2026-04-20","event":"Tyler Robert Buchanan (\"Tylerb\"), a separately charged alleged Scattered Spider member, pleads guilty to wire fraud conspiracy and aggravated identity theft.","source":"The Register / Krebs on Security","source_url":"https://www.theregister.com/security/2026/04/20/us-gets-second-scattered-spider-linked-guilty-plea/5220131"},{"date":"2026-06-30","event":"Peter Stokes makes initial appearance in Chicago federal court and is ordered held pending trial.","source":"Decrypt","source_url":"https://decrypt.co/372665/scattered-spider-suspect-extradited-to-us-over-8m-crypto-ransom-demand"},{"date":"2026-07-01","event":"DOJ announces Stokes' extradition from Finland to the United States and unseals charges of conspiracy, computer intrusion, and fraud.","source":"WTTW Chicago News / crypto.news","source_url":"https://news.wttw.com/2026/07/01/feds-accuse-teen-conspiracy-fraud-connection-scattered-spider-criminal-cyber-hacking"},{"date":"2026-07-16","event":"Owen Flowers and Thalha Jubair, alleged Scattered Spider members, sentenced to 5.5 years each at Woolwich Crown Court for the £29 million Transport for London hack.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/07/two-scattered-spider-hackers-get-55.html"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 98e7bd6d-9bfb-4f52-92ac-302ec248c188copy