The U.S. Department of Justice recently announced the arrest and indictment of a 19-year-old hacker named Peter Stokes, who is accused of participating in the notorious cybercriminal organization “Scattered Spider.” In May 2025, he successfully breached the systems of a luxury jewelry retailer and extorted $8 million (approximately NT$260 million) in cryptocurrency ransom. Although he used VPNs and tunneling services throughout the operation to conceal his real IP location, he was ultimately betrayed by a long-controversial built-in feature in Windows systems—the telemetry data of the “Global Device Identifier” (GDID).
The US Department of Justice Successfully Arrests a 19-Year-Old Prodigy Hacker, Only to Have the Downfall Caused by a Hidden Windows GDID Feature
Case Details: The “Genius” Criminal Path of a 19-Year-Old Hacker
According to the U.S. Department of Justice, which made public on July 1stIndictmentPeter Stokes, a 19‑year‑old dual citizen of the United States and Estonia, operates in the hacker community under aliases such as “Bouquet,” “Spencer,” and “Jordan.” He is associated with Scattered Spider, a hacker group notorious for social‑engineering attacks that target large enterprises’ IT service desks for intrusion. CISA (the Cybersecurity and Infrastructure Security Agency) has issued a dedicated threat advisory warning about this group.
In May 2025, Stokes and accomplices targeted a luxury jewelry retailer for an attack. They impersonated company employees and called the IT help desk, successfully tricking support staff into revealing password reset information and gaining access to three accounts. After breaching the network, they stole a massive amount of customer data and corporate secrets (approximately 77GB) and demanded an $8 million cryptocurrency ransom from the jeweler. Although the retailer ultimately managed to evict the hackers from its network and did not pay the ransom, the subsequent business disruption and system recovery costs still resulted in losses exceeding $2 million (approximately NT$65 million).
Stokes demonstrated considerable anti-detection awareness during the commission of the crime: throughout the entire operation, he used VPN services and the ngrok tunnel protocol to deeply encrypt and reroute network traffic, attempting to make his real IP location untraceable. However, he overlooked a critical issue: the Windows computer he was using itself was a location tracker that never powered off.
Windows GDID: Microsoft’s “Built-in GPS”
GDID (Global Device Identifier) is a unique identifier automatically generated during each Windows installation, used to collect device-specific telemetry data. This identifier is bound to the device’s underlying hardware characteristics, and even if the network is changed, IP address is altered, or the system is reinstalled, the GDID remains unchanged as long as the core hardware such as the motherboard is not replaced.
The FBI hit a technical bottleneck while investigating this jeweler intrusion case. Traditional IP tracking proved completely ineffective because Stokes had used multiple proxies and encrypted tunnels. However, investigators discovered that while network-layer information can be forged, the GDID recorded in Windows telemetry data serves as an unforgeable fingerprint.
A U.S. court subsequently ordered Microsoft to hand over telemetry traces corresponding to the time of the attack. The data provided by Microsoft directly confirmed that the device GDID used to launch the attack matched exactly with the Windows device that Peter Stokes personally used. The FBI further cross-referenced that GDID’s login records and browsing activity across various websites and social media platforms, ultimately identifying Stokes’s true identity.
Caught in Finland after flaunting wealth, self-destructive exposure
Peter Stokes was arrested by local police in Finland in April of this year based on an Interpol Red Notice, and was extradited to Chicago, USA in early July to stand trial. He has been charged with conspiracy, computer fraud, wire fraud, and other offenses.
Interestingly, beyond the technical breakthrough provided by Windows GDID, Stokes’ habit of flaunting his wealth also served as a supplementary clue in helping police track his whereabouts. He frequently posted on Snapchat photos of himself staying at luxury hotels, driving supercars, and splurging money. These various displays of wealth made it easier for investigators to connect his anonymous online identity to his real-life self. When he was arrested at the airport, two hard drives containing crucial criminal evidence were found in his carry-on luggage, which would become key evidence in the subsequent prosecution.
Proton Goes on Offense: Windows Is Just Spyware
After this case came to light, it sparked discussions in the cybersecurity community that went far deeper than the “hacker caught” narrative. Proton, the company behind privacy services like Proton VPN and Proton Mail, publiclyPostPointing the finger at Microsoft, directly stating: “Windows actually has spyware characteristics.”
Proton points out that Windows’ GDID mechanism never obtained users’ explicit informed consent when tracking and recording device information. In Microsoft’s vast collection of technical documents, GlobalDeviceId (GDID) only appears in an extremely obscure low-level technical document that everyday users would never come across. Users have no option to disable this tracking, nor can they clear the generated GDID identifier—the only way to completely remove it is to replace the motherboard.
Although GDID played a positive role in “fighting crime” in this case, it also means that the scale and depth of the telemetry database Microsoft collects in the background has reached a level sufficient to locate individual physical devices at any time. Proton emphasized: “Users never consented to being tracked this way, and have no way to opt out.”
Scattered Spider: The Hacker Empire Behind $100 Million+ in Fraud
Scattered Spider is one of the most active cybercrime organizations in recent years, known for precise social engineering attacks. Members of the group typically impersonate IT support personnel, calling target companies’ help desks and using psychological manipulation tactics to trick employees into revealing credentials, thereby gaining access to corporate internal systems. According to statistics, Scattered Spider has been linked to over 100 cyber intrusion cases, with cumulative profits exceeding $100 million (approximately NT$3.25 billion).
Their attacks have targeted multiple industries, including tech companies, financial institutions, healthcare organizations, and retailers. In 2023, the group breached casino giants MGM Resorts and Caesars Entertainment, causing tens of millions of dollars in damages and gaining notoriety.
Conclusion
This case serves as a wake-up call for all users who rely on VPNs and encryption tools to protect their privacy: no matter how robust your network-layer defenses are, operating system-level telemetry data can still become a vulnerability. For average users, the existence of Windows GDID means Microsoft has the capability to track the activity footprint of every Windows device long-term without explicit consent. Is this a tool for fighting crime or a ticking time bomb for privacy invasion? The answer may depend on which side you stand—law enforcement or personal privacy rights.
Additionally, this document from the US Department of Justice / Northern District of Illinois federal courtProsecution documentsThe content is quite comprehensive, covering the entire method of operation, how to use social engineering to request 2FA resets for employee accounts, thereby gaining access to the internal support system to view user support tickets and personal information.
The document cites chats between Stokes and his co-conspirators, including details about searching for support tickets, remote desktop access, disabling accounts, conversations like “don’t talk about this on Company H’s platform, go to Telegram,” as well as attack methods and how the FBI countered each move—those interested can check out the full original text.
Source: KOCPC Chinese