Alleged Scattered Spider Hacker, a Teenager, Faces Federal Charges in the U.S.
A 19-year-old dual citizen of the United States and Estonia, apprehended in Finland, is facing federal charges in the U.S. for allegedly being a key member of the **Scattered Spider** hacking collective. The suspect, known online as "Bouquet," is accused of extorting millions from corporations worldwide.

According to reports from the **Chicago Tribune**, the individual, using the alias "Bouquet," allegedly played a significant role in extorting millions of dollars from several large corporations globally.
The suspect was reportedly arrested by Finnish law enforcement at Helsinki's airport on April 10 while attempting to board a flight to Japan. The charges include wire fraud, conspiracy, and computer intrusion.
Prosecutors filed a complaint in December stating that "Bouquet" was involved in at least four **Scattered Spider** breaches. One notable incident was the March 2023 hack of an online communication platform, which occurred when the suspect was only 16 years old. These breaches resulted in the victim companies paying millions in ransoms.
One of the victims included an unnamed multibillion-dollar "luxury item retailer" in May 2025. The hackers allegedly impersonated employees to reset authentication credentials, gaining access to administrator accounts. They then demanded $8 million for the return of 100 gigabytes of stolen data. Although the company refused to pay the ransom, it incurred over $2 million in remediation costs.
## The Scattered Spider cybercrime collective
**Scattered Spider** (also tracked as 0ktapus, Scatter Swine, Octo Tempest, Starfraud, UNC3944, and Muddled Libra) emerged in 2022. It is a loosely organized, financially motivated hacking group consisting mainly of teenagers and young adults from the U.S. and Great Britain.
According to the **FBI**, the group employs social engineering, targeted multi-factor authentication (MFA) bombing (aka MFA fatigue), and SMS credential phishing attacks. These tactics are used to steal user credentials and sensitive documents, which are then used for extortion after breaching their targets' networks.
**Scattered Spider**'s victims include **Caesars**, **MGM Resorts**, **Riot Games**, **MailChimp**, **Twilio**, **DoorDash**, **Reddit**, **Allianz Life**, UK retailers **Co-op**, **Marks & Spencer (M&S)**, and **Harrods**, and, more recently, **WestJet** and **Jaguar Land Rover (JLR)**.
Earlier this month, **Tyler Robert Buchanan**, believed to be one of **Scattered Spider**'s leaders, pleaded guilty in the United States to charges of wire fraud and aggravated identity theft.