One less spider on the web
Scattered Spider just lost one of its own to the US justice system. Peter Stokes, a 19 year old dual US and Estonian citizen, was arrested in April at Helsinki airport as he tried to board a flight to Japan. He has now been extradited and appeared in federal court in Chicago on fraud, conspiracy and computer intrusion charges (BleepingComputer).
That's good news. But the more important story isn't the arrest; it's how the breaches happened in the first place.
A phone call, a reset, an admin account
Prosecutors tie Stokes to at least four Scattered Spider breaches. The one that should keep every CISO up at night hit a multibillion dollar luxury retailer in May 2025.
The attackers called the company's IT helpdesk and pretended to be employees. They asked for credential resets... and got them. From there they walked straight into administrator accounts, claimed to have stolen 100 GB of data, and demanded an $8 million ransom.
The company refused to pay. It still spent more than $2 million on disruption and cleanup. Saying no to the extortion didn't make the breach free; the damage was done the moment the helpdesk handed over access.
Same move, every single time
This isn't a one off. Scattered Spider has been running the same play since 2022 against MGM Resorts, Caesars, Marks & Spencer, Co-op, Harrods, Jaguar Land Rover and many more. The DOJ says the group is behind more than 100 intrusions and over $100 million in ransom payments.
The playbook is simple:
- Research a real employee using LinkedIn, breach data and social media.
- Call the helpdesk sounding stressed, rushed and convincing.
- Ask for a password reset or a new MFA device.
- Log in as that employee and escalate from there.
No malware. No zero day. No exploit. Just a voice on the phone that the helpdesk believed.
Why arrests won't close this gap
Helpdesk agents are measured on speed and customer satisfaction. Their job is to get people back to work. That makes them the perfect target for someone who sounds like a locked out employee with a deadline.
Most identity checks at the service desk still rely on things an attacker can find or guess: employee ID, manager's name, last four of a phone number, a callback to a number the attacker already controls. And with AI voice cloning, "I recognized their voice" is no longer a control at all.
Arresting one 19 year old doesn't change any of that. Scattered Spider is a loose collective; others will keep making the same calls, and copycats are learning from them. The fix has to happen at the moment the call comes in.
Verify first, then reset
The lesson is simple: confirm who is actually on the other end of the line before you touch their access, not after the damage is done. In practice that means:
- Treat every password reset, MFA change and new device enrollment as a high risk event.
- Retire knowledge based questions; anything on LinkedIn or in a breach dump is not proof of identity.
- Require strong, phishing resistant verification of the person, not just the account.
- Give helpdesk agents a clear, fast process so doing the secure thing is also the easy thing.
This is exactly why we built 909Shield. It verifies the real person behind a helpdesk request before any credentials change hands... so a convincing voice is never enough to walk into your environment.
Scattered Spider didn't hack their way in. They called in. Make sure the next call gets stopped at hello.
Learn more at 909shield.ai.
Sources
- Alleged Scattered Spider hacker extradited to the United States, BleepingComputer
.svg)
.svg){kind=icon}
