The Department of Justice announced July 1 that Peter Stokes, 19, a dual U.S.-Estonian citizen, has been extradited from Finland to face federal cybercrime charges in the Northern District of Illinois [1]. Finnish authorities arrested Stokes in April 2026 pursuant to an Interpol Red Notice [1]. He appeared in federal court in Chicago on June 30 and was ordered detained pending trial [1].
Stokes faces charges of conspiracy, computer intrusion, and fraud as an alleged member of Scattered Spider, a financially motivated cybercrime group the DOJ alleges has conducted more than 100 network intrusions resulting in over $100 million in ransom payments [1][2]. Scattered Spider has drawn sustained federal attention for targeting large enterprises, including attacks on hospitality and gaming sector companies, using social engineering techniques such as SIM swapping and phishing to bypass multi-factor authentication [2]. The group operates loosely, with members communicating through encrypted channels, which has complicated prosecution efforts [2].
The extradition is part of Operation Riptide, a coordinated DOJ initiative targeting Scattered Spider's alleged membership [1]. The case is being prosecuted by the U.S. Attorney's Office for the Northern District of Illinois in coordination with the DOJ's Computer Crime and Intellectual Property Section and the FBI [1]. Finland's National Bureau of Investigation handled the arrest and extradition logistics [1]. The charges against Stokes represent the latest in a series of Scattered Spider-related indictments; prior defendants have been charged in other federal districts, and at least one earlier defendant entered a guilty plea in related proceedings [2].
Stokes's detention order means he will remain in federal custody while the case proceeds. Defense counsel has not entered a public statement on the charges. The government's next step will be to proceed through the arraignment and pre-trial discovery phases in the Northern District of Illinois. Given the complexity of multi-defendant cybercrime conspiracies and the transnational scope of the alleged conduct, the case is likely to involve substantial pretrial litigation over evidence gathered through international legal assistance channels [2].