A teenager alleged to be a member of the cyber hacking group Scattered Spider, which was linked to attacks on M&S and Transport for London (TfL) has been arrested.
Peter Stokes, 19, was arrested in Finland in April and extradited to the US following an Interpol Red Notice, the US Department of Justice has said.
He appeared in federal court in Chicago on Tuesday, charged with computer intrusion, conspiracy and fraud.
He was ordered to remain in custody.
According to the DoJ, criminal cyber-hacking group Scattered Spider has been involved in hacks that have resulted in £75million of ransom payments.
Also called UNC3944, Octo Tempest or Muddled Libra, Scattered Spider is a hacking group comprised of hackers – some thought to be as young as 16.
Members are said to frequent hacker forums, Telegram channels and Discord servers.
The complaint alleges that, among other offences, Stokes and other co-conspirators breached the computer system of a luxury jewellery retailer, exfiltrated company data and made a ransom demand of approximately $8m (£6m) in cryptocurrency in May 2025.
No ransom was paid after the unnamed company “evicted” the hackers, the DoJ said.
However, the jewellery company lost at least $2m due to business disruption, investigation and mitigation of the threat.
The charges come after two men pleaded guilty to offences linked to the £39 million 2024 cyber-attack on Transport for London, which the UK’s National Crime Agency (NCA) believes was carried out by the group.
