Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker

Recent court filings have shed light on how federal investigators leveraged a persistent Windows device identifier to connect an alleged member of the Scattered Spider hacking group to a high-profile breach at a luxury jewelry retailer. This development underscores the critical role digital forensics plays in modern cybercrime investigations, even against sophisticated threat actors. According to a newly unsealed federal complaint, prosecutors were able to trace the intrusion back to a specific individual through technical artifacts that many attackers might overlook as forensic evidence.

The case centers on a May 2025 breach where threat actors gained unauthorized access to a luxury jewelry retailer's systems. What makes this particular investigation noteworthy is how investigators used a Windows device ID to establish a digital trail. Microsoft records revealed that this unique identifier was first associated with the account the attackers maintained during the intrusion. The same device ID was subsequently linked to personal online accounts belonging to nineteen-year-old Peter Stokes, whom authorities have identified as an alleged participant in the Scattered Spider collective. This discovery provides a compelling example of how technical evidence can bridge the gap between cybercriminal activities and real-world identities.

The implications for security teams are significant and multifaceted. This case demonstrates that even sophisticated threat actors who implement operational security measures may leave behind traceable digital artifacts. For organizations handling sensitive data, this reinforces the importance of comprehensive logging and retention policies that preserve forensic evidence across systems. Security professionals should consider how their current environments maintain and document device identifiers, authentication records, and other digital breadcrumbs that could prove valuable in post-incident investigations. Additionally