- U.S. prosecutors linked a Scattered Spider hacker to a luxury jewelry retailer intrusion using a persistent Windows device ID, according to a newly unsealed federal complaint.
- Nineteen-year-old Peter Stokes, known online as “Bouquet,” faces conspiracy, computer intrusion, and fraud charges after being extradited from Finland and appearing in Chicago court.
- The hacker cell demanded $8 million in cryptocurrency but the retailer refused to pay; the breach still cost the company about $2 million in disruption and cleanup.
U.S. prosecutors linked an alleged Scattered Spider hacker to a May 2025 break-in at a luxury jewelry retailer using a persistent Windows device ID, according to a newly unsealed federal complaint. Microsoft records tied that ID to a Windows installation, then to online accounts belonging to 19-year-old Peter Stokes, a dual U.S.-Estonian citizen known as “Bouquet.”
Stokes was extradited from Finland and made his first court appearance in Chicago on June 30. He is presumed innocent pending trial.
Between May 12 and 15, attackers phoned the retailer’s IT help desk, impersonated locked-out employees, and convinced staff to reset passwords and multifactor authentication devices. Within hours, they controlled three accounts, including two belonging to IT administrators, installed tunneling tools, and exfiltrated at least 77 gigabytes of data.
The attackers sent a ransom email demanding $8 million in cryptocurrency, but the company did not pay. The breach still cost the retailer roughly $2 million in disruption, investigation, and cleanup.
Investigators traced the attack back to a device that opened an ngrok account. Microsoft told the FBI that the Global Device Identifier g:6755467234350028 was tied to a single Windows installation.
The same device matched IP addresses and timestamps for Snapchat, Apple, and Facebook accounts prosecutors attribute to Stokes, including locations in Estonia, New York, and Thailand. His Snapchat posts flaunted cash and jewelry reading “HACK THE PLANET,” aligned with his travel data.
Separate research from Group-IB argues Scattered Spider is a loose collective of small, independent cells rather than a single group. Group-IB compares it to the Anonymous movement and says arresting some of these cells “will not stop the threat itself.”
Prosecutors describe Scattered Spider as one group behind more than 100 intrusions and over $100 million in ransoms. In a network this diffuse, the two 2-terabyte hard drives seized from Stokes in Helsinki could yield more intelligence than the conviction itself.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
