A teenager alleged to be a member of the criminal cyber hacking group Scattered Spider - which was linked to attacks on M&S and Transport for London - has been arrested, according to US authorities.
The FBI and Department of Justice announced on Wednesday that Peter Stokes had been detained after being extradited to the US to face charges of conspiracy, cyber intrusion, and fraud.
Stokes, a 19-year-old dual citizen of the US and Estonia, was arrested in Finland in April following an Interpol Red Notice - a worldwide request to law enforcement to locate and provisionally arrest an individual.
He was extradited to the US last week and made an initial appearance in federal court in Chicago on Tuesday, where he was ordered to remain in custody.
Among other offences, it is alleged that Stokes and other co-conspirators breached the computer system of a luxury jewellery retailer, exfiltrated company data and made a ransom demand of approximately $8m (£6m) in cryptocurrency in May 2025.
No ransom was paid after the retailer's security personnel successfully evicted the threat actors, but the disruption is believed to have caused a loss of around $2m (£1.5m).
Andrew S Boutros, attorney for the Northern District of Illinois, said the charges against Stokes "underscore our unwavering commitment to keeping pace with technologically-savvy criminal actors and holding accountable those who seek to profit from cyber intrusions, including those located in foreign jurisdictions who do harm to American businesses and victims."
Who are Scattered Spider?
Scattered Spider, also known as Octo Tempest, UNC3944, and 0ktapus, is a cybercriminal group linked to more than 100 network intrusions, resulting in more than $100m (£75m) in ransom payments and millions of dollars in damages to victims.
Some members of the group are believed to be as young as 16, with the group meeting up on hacker forums online.
Read more from Sky News:
How much did Trump make from crypto last year?
Nancy Guthrie ransom notes were fake, FBI says
Brett Leatherman, assistant director of the FBI's cyber division, said that Scattered Spider has "repeatedly targeted US companies, extorting employees, inflicting millions of dollars in losses, and disrupting essential operations".
However, he insisted the FBI would "continue to identify, disrupt, and hold cybercriminals accountable, no matter where they are located."
In recent years, the group has also been linked to a number of high-profile cyber attacks affecting UK businesses such as Jaguar Land Rover and M&S, as well as an attack in 2024 that cost Transport for London an estimated £39m.
Graeme Stewart, head of public sector at security company Check Point, said Scattered Spider is made up of "young, English-speaking individuals, mainly based in the UK and the US", and described the group as "one of the most dangerous and active hacking groups we are monitoring".
(c) Sky News 2026: Alleged member of international cyber hacking group Scattered Spider arrested
The desperate measure being taken to avoid having travellers as neighbours
Boy, 16, has potentially life-threatening injuries after shooting near Birmingham mosque
Parents and grandparents charged after 16 children found living in squalor in Ohio
