A teenager has been arrested for alleged involvement with the Scattered Spider hacking group, the US Department of Justice (DoJ) has said.
Peter Stokes, 19, was arrested in Finland in April and extradited to the US following an Interpol Red Notice.
He has been charged with computer intrusion, conspiracy and fraud, which the DoJ said came after “years of work”.
Scattered Spider has been involved in hacks resulting in more than $100m (£75m) in ransom payments, according to the DoJ.
The charges come after two young men pleaded guilty to offences connected to the £39m 2024 Transport for London cyber-attack, which the UK National Crime Agency (NCA) believed was conducted by the group.
Stokes, a dual US-Estonian national, appeared in federal court in Chicago on Tuesday and was ordered to remain in custody.
The complaint alleges that, among other offences, he and other co-conspirators made a ransom demand of around $8m in cryptocurrency to a luxury jewellery retailer after stealing its data last year.
No ransom was paid after the unnamed company “evicted” the hackers, the DoJ said.
However, it added, the jewellery company lost at least $2m due to business disruption, investigation and mitigation of the threat.
Both the FBI – working in Copenhagen and Chicago – and Finland’s National Bureau of Investigation worked on the operation.
The charges against Stokes come after two men pleaded guilty last month to offences in connection with a massive cyber attack on Transport for London in 2024.
Investigators from the NCA said they believed the 2024 “network intrusion” – in which around 10 million people’s data was stolen – was carried out by Scattered Spider.
The NCA told the BBC Scattered Spider was also a key part of their investigation into cyber attacks on British retailers Co-op and M&S last year.
The group’s members are thought to be young, native English speakers from the US and UK.
