A 19-year-old accused Scattered Spider member was extradited from Finland to the United States to face charges tied to hacking and extortion. The FBI says Peter Stokes helped breach an unnamed luxury jewelry retailer around May 12, 2025 by calling the IT help desk from Google Voice numbers, posing as employees, and getting password and multifactor authentication resets; the attackers allegedly compromised three accounts, including two IT administrator accounts, used ngrok for persistent access, stole data, and demanded $8 million in cryptocurrency.
Why it matters: This matters because it gives defenders a concrete look at how Scattered Spider is still using help-desk impersonation to break into companies without exploiting software flaws. Organizations, especially those with privileged IT accounts, should harden help-desk identity checks, review MFA reset procedures, and monitor for unauthorized remote-access tools such as ngrok.
2026.07.07
86% relevant
This article adds specific investigative detail from the Peter Stokes case, explaining that prosecutors relied in part on Microsoft's Windows Global Device Identifier, plus ngrok and VPN records, to link online activity to the alleged Scattered Spider member tied to the same extradition and charging event.
Ionut Arghire
2026.07.03
98% relevant
This article is the same underlying event: the U.S. extradition of 19-year-old Peter Stokes over the May 2025 intrusion and $8 million extortion attempt against a jewelry retailer, and it adds background on Scattered Spider's broader activity and prior guilty pleas.
Sergiu Gatlan
2026.07.02
98% relevant
This is the same extradition event and adds the suspect's name, age, dual U.S.-Estonian citizenship, prior Finland arrest details, aliases, the allegation that he participated in at least four Scattered Spider breaches including a 2023 communications-platform hack, and updated DOJ/FBI framing of the group's broader impact.
2026.07.01
100% relevant
This article establishes a distinct tracked event by identifying an extradited suspect, the victim profile, the timeline, and the specific help-desk social-engineering technique used in an alleged Scattered Spider breach and extortion attempt that is not the same underlying event as the existing TfL guilty-plea story.
← Back to all stories