He Demanded $8 Million, Then Posted the Diamonds on Snapchat
He allegedly helped a hacking group extort over $100 million. He demanded $8 million in crypto from a jewelry retailer. Then he posted photos of himself in Dubai wearing a diamond 'HACK THE PLANET' necklace. The FBI pulled the evidence straight off his Snapchat.
The smartest thing about Scattered Spider was that they never touched code they did not have to. The dumbest thing was Peter Stokes posting the receipts on Snapchat.
Stokes is 19. Dual US-Estonian citizen. Online he went by "Bouquet." Prosecutors say he was an active member of Scattered Spider, the English-speaking cybercrime crew also tracked as Octo Tempest, UNC3944, and 0ktapus. The group's specialty is not breaking encryption. It is calling up an IT help desk, sounding convincing, and talking a human being into resetting someone's two-factor authentication. Social engineering. The oldest hack there is. It works because there is always someone at a support desk who wants to be helpful.
The government says Stokes started young. The earliest alleged attack happened when he was 16, targeting an online communications platform by convincing its IT support to reset an employee's login. From there the group ran the same play across more than 100 network intrusions since March 2023, extorting over $100 million in ransom payments. Once inside a corporate network, Scattered Spider does not just steal and encrypt data. They render the systems inoperable, then squeeze the victim for a crypto ransom while the business bleeds.
The charge that got Stokes extradited centers on a luxury jewelry retailer. In May 2025, the group breached the retailer's systems and stole data. The follow-up email had the subject line "IMPORTANT: WE STOLE THE DATA, CONTACT UMMEDIATELY," misspelling and all. The demand: $8 million in crypto. The retailer refused to pay, evicted them from the network, and ate roughly $2 million in disruption damages instead. The court filings do not name the victim, but the timing lines up with the wave of attacks that hit British retailers including Marks & Spencer and Harrods.
Scattered Spider had a habit of taunting the people chasing them. One 2024 screenshot in the filings reportedly shows failed login attempts captioned "F*** off, FBI." That confidence is the throughline of the whole group, and it is exactly what took Stokes down.
Because Bouquet could not stop flexing.
Court records describe trips to Dubai, Thailand, Mexico, and New York. Snapchat photos of cash, watches, and jewelry. And the centerpiece, the image that will follow him into every courtroom: a diamond-encrusted necklace spelling out "HACK THE PLANET," the catchphrase from the 1995 cult film Hackers. The FBI pulled that photo directly off his Snapchat. He built the prosecution's evidence board himself, one post at a time, and hung a diamond confession around his own neck.
He was arrested in Finland in April on an Interpol Red Notice, extradited to the US, and appeared in a Chicago federal court in July 2026. The complaint details four specific cyber incidents, including the jewelry heist and the $8 million ransom demand, plus the seizure of two 2TB hard drives. He now faces multiple federal hacking and fraud charges.
Stokes is one of the very few arrests authorities have actually pinned to Scattered Spider, which is part of why the case matters. The group has been blamed for some of the most destructive corporate attacks of the past two years. The rebranded "Scattered LAPSUS$ Hunters" collective was tied to the ransomware campaigns against Marks & Spencer and Jaguar Land Rover, incidents that ran into more than $300 million and $2.5 billion in losses respectively. FBI Cyber Division Assistant Director Brett Leatherman put it plainly: the group has repeatedly targeted US companies, extorted employees, inflicted millions in losses, and disrupted essential operations.
Ransomware crews pulled in more than $820 million in crypto payments last year. Attacks rose 50%. Arrests did not keep pace. Scattered Spider stayed ahead largely because its members are hard to identify - anonymous handles, no faces, no names. Stokes had all of that protection and threw it away for a photo op.
He is 19 years old. He allegedly helped extort over $100 million from companies across two continents. And the thing that may put him away is a piece of jewelry he bought to brag about it. The necklace said HACK THE PLANET. It should have said EXHIBIT A.
The Aftermath
Stokes was extradited from Finland and arraigned in a Chicago federal court in July 2026 on multiple hacking and fraud charges tied to four cyber incidents, including the $8 million jewelry-retailer ransom. He is one of only a handful of arrests authorities have publicly tied to Scattered Spider, a group blamed for some of the most damaging corporate ransomware campaigns of 2025, including attacks on Marks & Spencer and Jaguar Land Rover with combined losses exceeding $2.8 billion. His own social media - Snapchat photos of cash, luxury travel, and the diamond 'HACK THE PLANET' necklace - formed a substantial part of the evidence against him. The case underscored both the effectiveness of the group's social-engineering tactics and the vulnerability created when members trade operational anonymity for public displays of wealth.
COMMENTS