U.S. authorities extradite 19-year-old linked to Scattered Spider hacking group

U.S. authorities announced Wednesday that a 19-year-old dual U.S.-Estonian national was arrested in Finland in April and extradited to face charges linked to the Scattered Spider hacking group. The Justice Department said the individual appeared Tuesday in federal court in Chicago, where a judge ordered him to remain in custody pending further proceedings.

alleged incident A criminal complaint alleges that the defendant and coconspirators targeted a luxury jewelry retailer's computer system in May 2025, exfiltrating data and demanding roughly $8 million in cryptocurrency. No ransom was paid after the company's security staff removed the threat actors from the network.

The retailer still reported at least $2 million in losses from business disruption, investigation, and mitigation costs.

prior activity Scattered Spider, also known as Octo Tempest, UNC3944, or 0ktapus, is described by the FBI as a network of criminal cyber actors that has conducted more than 100 network intrusions worldwide. The FBI links the group to more than $100 million in ransom payments and millions of dollars in additional damages across the United States and United Kingdom.

In June, two men pleaded guilty in the United Kingdom to breaching Transport for London's network between 31 August and 3 September 2024. " — Paul Foster, head of the NCA’s National Cyber Crime Unit The UK's National Crime Agency said the breach forced all 28,000 TfL employees to reset passwords in person and cost the agency £29 million in loss and recovery expenses.