Scattered Spider's "Bouquet" Arrested in Finland, Faces Federal Charges in the U.S.

Peter Stokes, 19, a dual U.S.-Estonian citizen from Chicago known online as "Bouquet," was arrested at Helsinki Airport on April 10 while attempting to board a flight to Tokyo. Finnish authorities seized two 2-terabyte hard drives at the time of his detention. The U.S. is now seeking his extradition. A six-count federal complaint filed under seal in December charges Stokes with wire fraud, conspiracy and computer intrusion. Prosecutors allege he participated in at least four Scattered Spider breaches, including one carried out in March 2023 when he was just 16 years old. One of the attacks targeted a multibillion-dollar luxury retailer in May 2025, where the group social engineered their way in by impersonating employees requesting credential resets, gained access to IT admin accounts, and demanded an $8 million ransom. The company refused to pay, but downtime and mitigation costs exceeded $2 million. Stokes apparently had no issues flaunting it. Social media posts showed luxury hotels, cash, expensive jewelry and international travel funded by the proceeds. He reportedly compared his crew to the Soprano crime family, writing his own name over the show's lead character. The arrest is part of a broader crackdown on Scattered Spider, a loosely organized, mostly English-speaking collective of teenagers and young adults tied to the larger cybercriminal network known as The Com. The group is responsible for high-profile hits on MGM Resorts, Caesars Entertainment, Marks & Spencer, Harrods, Coinbase, Twilio and dozens of others since 2022, relying on social engineering, SIM swapping and MFA fatigue attacks rather than technical exploits. Stokes is not the first member to face charges. Tyler Buchanan, 24, believed to be one of the group's senior figures, pleaded guilty earlier this month to charges tied to at least $8 million in stolen cryptocurrency. Noah Urban, 20, was sentenced to 10 years in federal prison last August. Two UK members are facing a combined maximum of 95 years.