U.S. Extradites Teen Suspect Linked to Scattered Spider Hacking Ring

The Department of Justice accuses Stokes of orchestrating a May 2025 intrusion where he and his associates bypassed security by impersonating employees during calls to the company’s IT help desk. By coercing staff into resetting passwords, the attackers gained administrative access to internal systems. While the jewelry retailer refused to pay the $8 million cryptocurrency ransom, the resulting business disruption and investigation costs exceeded $2 million.

Known by various aliases including Octo Tempest and 0ktapus, Scattered Spider has been tied to over 100 network breaches and more than $100 million in illicit ransom payments. The group specializes in social engineering, often bypassing advanced technical defenses by targeting the human element of corporate IT support. The Stokes case is a primary target of Operation Riptide, an FBI-led initiative aimed at dismantling the infrastructure and financial networks that support large-scale cyber extortion.

Despite a 35% drop in ransomware cashouts reported in 2024, the threat remains persistent as attackers pivot to more frequent, albeit less lucrative, strikes. Federal prosecutors are increasingly relying on blockchain forensics to connect digital wallet activity to real-world suspects, a strategy that continues to challenge the anonymity traditionally favored by cybercriminal syndicates.