Scattered Spider: 'Bouquet' Arrested in Helsinki Under US Charges
A 19-year-old dual US-Estonian citizen known as 'Bouquet' has been arrested in Helsinki on US charges related to the Scattered Spider hacking collective.
A 19-year-old citizen holding dual United States and Estonian citizenship, known online by the pseudonym 'Bouquet', was arrested at Helsinki airport on April 10, 2026. United States authorities formalized federal charges against him on the following April 28, accusing him of his alleged operational role within the Scattered Spider hacking collective. According to court documents, the young suspect was involved in at least four distinct cyber breaches, playing an active role in the criminal group's operations.
Scattered Spider profile and high-profile victims
Scattered Spider is a hacking collective active since at least 2022, primarily composed of young individuals from the United States and the United Kingdom. The group became notorious for heavily striking the entertainment and retail sectors, targeting high-profile victims such as MGM Resorts and Caesars Entertainment, as well as the British fashion giant Marks & Spencer. The group's attack strategy is based on complex social engineering tactics: members impersonate employees or authorized figures to reset login credentials and thus penetrate corporate systems, gaining control of internal networks.
Luxury retailer attack and economic damages
Among the most serious incidents attributed to the suspect is an attack on a luxury goods retailer that occurred in May 2025. In that instance, the hackers implemented impersonation techniques to reset access credentials, gaining control of the corporate network. Once access was consolidated, the group submitted a ransom demand of $8 million, threatening consequences in the event of non-payment.
Despite the company's decision to refuse payment of the requested sum, the incident generated over $2 million in direct costs related to the disruption of operational activities. This episode demonstrates the significant economic impact of these breaches even in the absence of a ransom payment: recovery costs, forensic investigations, and production outages often prove as damaging as the extortion demands themselves.
Judicial context: Tyler Buchanan's guilty plea
The arrest of 'Bouquet' comes at a decisive stage for the Scattered Spider investigations. A few days earlier, in early April 2026, Tyler Buchanan, considered one of the group's alleged leaders, pleaded guilty to wire fraud charges before US authorities. The capture of the 19-year-old in Helsinki and Buchanan's admission of responsibility mark a significant advancement for law enforcement in their attempt to dismantle the criminal network, which has represented a concrete threat to major international corporations for years.
A young and aggressive group
The demographic composition of Scattered Spider reflects a worrying trend in the cybersecurity landscape: a group composed mostly of young Americans and Britons, capable of causing massive economic damage thanks to their mastery of social engineering tactics.
Frequently Asked Questions
- What is the Scattered Spider group?
- Scattered Spider is a hacking collective active since 2022, primarily composed of young Americans and Britons. It has targeted high-profile companies such as MGM Resorts, Caesars Entertainment, and Marks & Spencer.
- How does Scattered Spider operate during attacks?
- The group uses social engineering tactics where members pose as employees or authorized figures to reset credentials and gain access to victims' systems, subsequently demanding ransoms or causing disruptions.
- Who is 'Bouquet' arrested in Finland?
- He is a 19-year-old citizen with dual US-Estonian citizenship, arrested at Helsinki airport on April 10, 2026, and formally charged by US federal authorities on April 28, 2026, for his role in Scattered Spider.
- What damage did the luxury retailer attack cause?
- The May 2025 attack involved an $8 million ransom demand. Despite non-payment, the company suffered over $2 million in business interruption costs.
- Who is Tyler Buchanan and what is his role in Scattered Spider?
- Tyler Buchanan is considered one of the alleged leaders of Scattered Spider. He pleaded guilty to wire fraud charges in early April 2026, shortly before the arrest of 'Bouquet' in Helsinki.
- Who are the known victims of Scattered Spider?
- Confirmed victims of the group include MGM Resorts, Caesars Entertainment, and Marks & Spencer, all large corporations in the entertainment and retail sectors.
Sources
- US Federal Court Documents: Formal indictment of suspect 'Bouquet' and details on cyber breaches (April 28, 2026).
- Security reports and judicial sources: Details on the Helsinki airport arrest, Scattered Spider group profile, and Tyler Buchanan's guilty plea (April 10, 2026 - early April 2026).