Peter Stokes
19-year-old alleged Scattered Spider member arrested in Helsinki, April 2026.
Last refreshed: 30 April 2026 · Appears in 1 active topic
Will Finland extradite the teenage Bouquet hacker to Chicago?
Timeline for Peter Stokes
Arrested at Helsinki airport on 10 April; faced unsealed federal charges listing wire fraud, conspiracy and computer intrusion
Cybersecurity: Threats and Defences: Scattered Spider's Bouquet arrested in Helsinki- Who is Peter Stokes the Scattered Spider hacker?
- Peter Stokes, known as Bouquet, is a 19-year-old dual US-Estonian citizen arrested in Helsinki on 10 April 2026. He is alleged to have participated in at least four Scattered Spider breaches, including one carried out when he was 16.Source: Bleeping Computer
- What is the Bouquet hacker charged with?
- US federal charges filed in December 2025 allege wire fraud, conspiracy, and computer intrusion connected to Scattered Spider breaches. Victims paid millions in ransoms.Source: Bleeping Computer
- Will Peter Stokes be extradited to the United States?
- The US is seeking extradition to Chicago following his arrest in Helsinki. Extradition proceedings are ongoing; Finland and the US have an extradition treaty.Source: Bleeping Computer
- How was the Bouquet hacker caught?
- Finnish National Bureau of Investigation (KRP) arrested Peter Stokes in Helsinki on 10 April 2026 as he attempted to board a flight to Japan, in co-operation with US law enforcement.Source: Bleeping Computer
Background
Peter Stokes, a 19-year-old dual US-Estonian citizen known online as Bouquet, was arrested in Helsinki on 10 April 2026 as he attempted to board a flight to Japan, becoming the most recently charged alleged member of the English-speaking cybercrime collective Scattered Spider. US federal charges filed under seal in December 2025 allege wire fraud, conspiracy, and computer intrusion. The United States is seeking extradition to Chicago; proceedings are ongoing.
Stokes is alleged to have participated in at least four Scattered Spider breaches, including a March 2023 compromise of an online communications platform carried out when he was 16 years old. Victims of attacks in which he is alleged to have participated paid millions in ransoms. The Finnish National Bureau of Investigation (KRP) conducted the arrest in co-operation with US law enforcement.
The Stokes arrest is a single-member enforcement win, not a collective takedown. Scattered Spider remains active. His dual nationality, a Finnish arrest, and a US extradition request illustrate the multinational law-enforcement effort required to pursue a group that operates in English across multiple countries and has historically evaded attribution.