US charges 19-year-old Scattered Spider suspect arrested at Helsinki airport

A dual US-Estonian citizen using the handle ‘Bouquet’ faces wire fraud, conspiracy, and computer intrusion charges after Finnish authorities detained him on April 10 as he tried to board a flight to Japan. A six-count complaint unsealed in December ties him to at least four Scattered Spider intrusions, including a 2023 breach of an online communications platform carried out when he was 16.

Prosecutors allege Bouquet helped extort millions from multinational targets. In one May 2025 incident against an unnamed luxury retailer, operators called the IT helpdesk impersonating staff, reset credentials, escalated to admin accounts, and demanded $8 million for 100 GB of claimed stolen data. The retailer refused but still absorbed more than $2 million in disruption and remediation costs.

The arrest follows the recent guilty plea of 24-year-old Tyler Robert Buchanan, considered one of the collective’s leaders. Scattered Spider — also tracked as Octo Tempest, UNC3944, and Muddled Libra — relies on social engineering, MFA fatigue, and SMS phishing, and has hit Caesars, MGM, Twilio, M&S, Co-op, WestJet, and Jaguar Land Rover, among others.