A 19-year-old dual American-Estonian national, Peter Stokes, has been arrested and extradited to the United States following allegations of his involvement in the Scattered Spider hacking group. The US Department of Justice (DoJ) announced this week that Stokes was apprehended in Finland in April and is now facing charges of computer intrusion, conspiracy, and fraud. These charges stem from incidents dating back over several years, according to the DoJ, which claims that Scattered Spider has been responsible for hacks resulting in more than $100 million in ransom payments. The accusations against Stokes follow two separate admissions of guilt by individuals connected to a massive cyber-attack on Transport for London in 2024. The UK National Crime Agency (NCA) believes that this attack, which resulted in the theft of data from around 10 million people, was carried out by Scattered Spider. Stokes made his first appearance in a federal court in Chicago on Tuesday and has been ordered to remain in custody. The complaint against him alleges that he and his co-conspirators demanded approximately $8 million in cryptocurrency from a luxury jewellery retailer after stealing their data last year. Despite the ransom not being paid, the jewellery company reportedly suffered losses of at least $2 million due to business disruption, investigation costs, and threat mitigation. The FBI, working in collaboration with law enforcement agencies in Copenhagen and Chicago, as well as Finland's National Bureau of Investigation, were involved in the operation leading to Stokes' arrest. The charges against Stokes come after the guilty pleas of two individuals last month in relation to the Transport for London cyber-attack. Investigators from the NCA also believe that Scattered Spider played a significant role in their investigation into cyber attacks on British retailers Co-op and M&S in 2021. The members of this group are thought to be young, native English speakers primarily from the US and the UK.