Skip to content
You can now search across every topic, entity and event.What's new
PS
PersonEE

Peter Stokes

19-year-old alleged Scattered Spider member arrested in Helsinki, April 2026.

Last refreshed: 24 July 2026 · Appears in 1 active topic

Key Question

Will Finland extradite the teenage Bouquet hacker to Chicago?

Timeline for Peter Stokes

#11 16 Jul

Mentioned in: TfL hackers jailed five and a half years

Cybersecurity: Threats and Defences
#6 31 May

Mentioned in: Ransomware tempo holds at 95 in May

Cybersecurity: Threats and Defences
#2 28 Apr

Arrested at Helsinki airport on 10 April; faced unsealed federal charges listing wire fraud, conspiracy and computer intrusion

Cybersecurity: Threats and Defences: Scattered Spider's Bouquet arrested in Helsinki
View full timeline →
Follow Cybersecurity: Threats and Defences →

Background

Peter Stokes, a 19-year-old dual US-Estonian citizen known online as Bouquet, was arrested in Helsinki on 10 April 2026 as he attempted to board a flight to Japan, becoming the most recently charged alleged member of the English-speaking cybercrime collective Scattered Spider. US federal charges filed under seal in December 2025 allege wire fraud, conspiracy, and computer intrusion. He was extradited to the United States around the start of July 2026 and made an initial appearance before a federal court in Chicago, where he was ordered detained pending further proceedings.

Stokes is alleged to have participated in at least four Scattered Spider breaches, including a March 2023 compromise of an online communications platform carried out when he was 16 years old, plus a luxury jewellery retailer breach in May 2025 and a US insurance company attack in June 2025. Victims of attacks in which he is alleged to have participated paid millions in ransoms. The Finnish National Bureau of Investigation (KRP) conducted the arrest in co-operation with US law enforcement.

The Stokes case is a single-member enforcement win, not a collective takedown. Scattered Spider remains active. His dual nationality, a Finnish arrest, and a completed US extradition illustrate the multinational law-enforcement effort required to pursue a group that operates in English across multiple countries and has historically evaded attribution.

Common Questions
Who is Peter Stokes the Scattered Spider hacker?
Peter Stokes, known as Bouquet, is a 19-year-old dual US-Estonian citizen arrested in Helsinki on 10 April 2026. He is alleged to have participated in at least four Scattered Spider breaches, including one carried out when he was 16.Source: Bleeping Computer
What is the Bouquet hacker charged with?
US federal charges filed in December 2025 allege wire fraud, conspiracy, and computer intrusion connected to Scattered Spider breaches. Victims paid millions in ransoms.Source: Bleeping Computer
Will Peter Stokes be extradited to the United States?
The US is seeking extradition to Chicago following his arrest in Helsinki. Extradition proceedings are ongoing; Finland and the US have an extradition treaty.Source: Bleeping Computer
How was the Bouquet hacker caught?
Finnish National Bureau of Investigation (KRP) arrested Peter Stokes in Helsinki on 10 April 2026 as he attempted to board a flight to Japan, in co-operation with US law enforcement.Source: Bleeping Computer
Has Peter Stokes been extradited to the United States?
Yes. Stokes was extradited from Finland to the US around the start of July 2026 and made an initial appearance in federal court in Chicago, where he was ordered detained.Source: The Record
Source Material
US charges Scattered Spider member 'Bouquet': 19-year-old arrested in Finland