Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker

Back Thehackernews

Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker

Thehackernews •[email protected] (The Hacker News) • July 7, 2026

Share: View original

Learn how to secure AI agents with practical controls for access, visibility, secrets, and risk containment.

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Device ID Used to Track Scattered Spider Hacker Peter Stokes, a 19-year-old hacker, was arrested in Finland on April 10, 2026, for allegedly being part of the Scattered Spider hacking group. The FBI linked him to a US$8 million ransom demand against a luxury retailer using a Microsoft Global Device ID (GDID). Despite using a VPN, Stokes' GDID was identified through Microsoft telemetry and ngrok access records. The FBI's investigation revealed that Stokes' GDID was associated with multiple IP addresses across different countries, corroborated by Snapchat and Apple account access logs. Stokes faces six charges, including conspiracy and extortion, as part of a broader crackdown on the Scattered Spider group, which has been linked to over 100 attacks and more than US$100 million in extortion. The case raises concerns about user privacy and the potential for abuse of device tracking technologies. 14 sources 49

Extracted Entities

APT Groups (1)

Scattered Spider

Platforms (1)