Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker

A federal complaint has revealed that US prosecutors used a persistent Windows device ID to link an alleged Scattered Spider hacker to a breach at a luxury jewelry retailer. The device ID was tied to the account used by the attackers to maintain access during the intrusion. Microsoft records also connected the device ID to online accounts allegedly belonging to 19-year-old Peter Stokes. The intrusion occurred in May 2025, and the device ID played a key role in tracing the alleged hacker. The complaint has recently been unsealed, providing insight into the investigation. Prosecutors used the device ID to establish a connection between the breach and Stokes.