In a rare cross‑border case, a 19‑year‑old student with dual U.S. and Estonian citizenship was seized by Finnish police in April and later extradited to the United States. The extradition followed an Interpol Red Notice and is part of a wider targeting of a cyber‑crime network known as Scattered Spider.
The U.S. Department of Justice says the teenager participated in a scheme that stole sensitive data from a high‑end jewellery retailer last year and demanded an $8 million ransom in cryptocurrency. While the company did not pay the ransom, it suffered an estimated $2 million loss due to business disruption, forensic investigations and security mitigation.
Stokes appeared before a federal court in Chicago on Tuesday and was ordered to remain in custody. Prosecutors allege that he and other members of the group conspired to infiltrate corporate networks, exfiltrate data and threaten victims with financial harm.
The case follows earlier guilty pleas by two young men linked to a 2024 Transport for London cyber‑attack, which the National Crime Agency believes was carried out by Scattered Spider. That incident saw more than 10 million user account details compromised and a significant intrusion into the city's network.
Investigators—working in Copenhagen, Chicago and Finland—have linked the shop‑lifting spree, the jewellery hack and the TfL breach to the same young, native English‑speaking criminals from the U.S. and U.K. The investigation also implicates the group in attacks on other retailers such as Co‑op and M & S last year.
