U.S.authorities have charged 19-year-old dual U.S.-Estonian citizen Peter Stokes in connection with alleged ransomware and cyber intrusion activities attributed to the Scattered Spider cybercrime group.According to the Department of Justice, investigators claim the group has extorted more than $100 million from victims.The criminal complaint focuses on a May 2025 attack against a U.S.

-based luxury jewelry company, where attackers allegedly impersonated employees in calls to the company's IT help desk and convinced staff to reset account credentials.After obtaining administrator-level access, the attackers reportedly stole sensitive data and demanded an $8 million cryptocurrency ransom.

Although the company restored its systems without paying the ransom, prosecutors estimate the incident caused approximately $2 million in operational losses.

Investigators state that Microsoft provided Global Device Identifier (GDID) information and other account telemetry to the FBI, helping correlate a Windows installation with online activity, IP addresses, application usage, timestamps, and other digital evidence.

Authorities allege this information, together with additional forensic evidence, travel records, online activity, and social media posts, contributed to identifying and tracking the suspect.

Stokes was arrested while attempting to board a flight from Helsinki to Japan, and officials say he was carrying two hard drives containing incriminating evidence.He has since been extradited to the United States, where he appeared in federal court in Chicago on June 30, 2026.He faces charges including conspiracy, cyber intrusion, and fraud, and remains in custody awaiting further legal proceedings.

The case has also prompted renewed discussion about the extent of operating system telemetry and the role of technology companies in assisting law enforcement investigations.