Federal authorities have charged 19-year-old Peter Stokes, known online as “Bouquet,” for his alleged role in the notorious cybercriminal group Scattered Spider.
Law enforcement arrested the dual U.S. and Estonian citizen earlier this month in Helsinki as he attempted to board a flight to Japan.
At the time of his arrest, Stokes carried multiple electronics, including two high-capacity hard drives. The newly unsealed charges in Chicago accuse him of wire fraud, conspiracy, and computer intrusion linked to multimillion-dollar extortion campaigns.
Scattered Spider, also tracked by security researchers as Octo Tempest, consists primarily of teenagers and young adults operating across the U.S. and Europe. The group specializes in targeting enterprise IT help desks through advanced social engineering.
By impersonating legitimate employees over the phone or text, these attackers trick support staff into resetting multi-factor authentication credentials.
According to the Chicago Tribune, Stokes began participating in these sophisticated intrusions at just 16 years old. During an attack on an online communications platform in March 2023, he managed to steal sensitive data while coordinating with a juvenile accomplice.
Court documents show he casually noted in encrypted chats that he had to log off to attend school.
The Luxury Retailer Hack
The federal charges detail a major intrusion in May 2025 against a multibillion-dollar luxury retailer, identified as Company F. The attack timeline demonstrates the group’s highly efficient extortion methodology:
- Attackers made phishing calls to the IT help desk to request password resets.
- Hackers successfully compromised two high-privilege IT administrator accounts within hours.
- The group accessed a main internal server and extracted 100 gigabytes of sensitive corporate data.
- Stokes and his team emailed company personnel, demanding an $8 million ransom to prevent the publication of data.
While the retailer refused to pay the extortion demand, the incident still cost the company over $2 million in business disruption, investigation, and mitigation efforts.
Despite his youth, Stokes allegedly amassed substantial illicit wealth from his cyber activities. Court documents highlight a lavish lifestyle funded by ransom payments, featuring extensive international travel, luxury hotel stays, and photographs showing large amounts of cash.
In one notable image, Stokes wore a diamond-studded necklace spelling out “HACK THE PLANET.”
The young hacker also frequently taunted law enforcement agencies in encrypted chats with his co-conspirators. He shared memes comparing his crew to mafia bosses and sent screenshots mocking FBI tracking efforts.
The U.S. is currently seeking his extradition to Chicago to face trial, signaling a continued federal crackdown on the highly disruptive threat actors driving modern data extortion operations.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
