Peter Stokes
19-year-old alleged Scattered Spider member arrested in Helsinki, April 2026.
Last refreshed: 30 April 2026 · Appears in 1 active topic
Will Finland extradite the teenage Bouquet hacker to Chicago?
Timeline for Peter Stokes
Mentioned in: Ransomware tempo holds at 95 in May
Cybersecurity: Threats and DefencesArrested at Helsinki airport on 10 April; faced unsealed federal charges listing wire fraud, conspiracy and computer intrusion
Cybersecurity: Threats and Defences: Scattered Spider's Bouquet arrested in HelsinkiWho is Peter Stokes the Scattered Spider hacker?
What is the Bouquet hacker charged with?
Will Peter Stokes be extradited to the United States?
Background
Peter Stokes, a 19-year-old dual US-Estonian citizen known online as Bouquet, was arrested in Helsinki on 10 April 2026 as he attempted to board a flight to Japan, becoming the most recently charged alleged member of the English-speaking cybercrime collective Scattered Spider. US federal charges filed under seal in December 2025 allege wire fraud, conspiracy, and computer intrusion. The United States is seeking extradition to Chicago; proceedings are ongoing.
Stokes is alleged to have participated in at least four Scattered Spider breaches, including a March 2023 compromise of an online communications platform carried out when he was 16 years old. Victims of attacks in which he is alleged to have participated paid millions in ransoms. The Finnish National Bureau of Investigation (KRP) conducted the arrest in co-operation with US law enforcement.
The Stokes arrest is a single-member enforcement win, not a collective takedown. Scattered Spider remains active. His dual nationality, a Finnish arrest, and a US extradition request illustrate the multinational law-enforcement effort required to pursue a group that operates in English across multiple countries and has historically evaded attribution.