Microsoft Windows device ID helped FBI trace teen hacker

A federal criminal case against an alleged teenage hacker has revealed a powerful and persistent tracking mechanism within Microsoft's Windows operating system, raising significant privacy concerns. Peter Stokes, a 19-year-old dual U.S.-Estonian citizen, was extradited from Europe last week and made his first court appearance in Chicago on June 30. He faces charges of conspiracy, computer intrusion, and fraud for his alleged role in the notorious Scattered Spider hacking group.

The case centers on a May 2025 intrusion into a luxury jewelry retailer. According to a 39-page criminal complaint unsealed in Chicago, attackers used social engineering, posing as locked-out employees in calls to the company's IT help desk to gain access. They then installed tunneling tools, including ngrok, to maintain their presence, exfiltrated at least 77 gigabytes of data, and attempted to deploy ransomware. The company did not pay an $8 million ransom demand but incurred approximately $2 million in related costs.

While the suspect allegedly used a VPN to obscure his location, investigators traced the activity back to him through records provided by Microsoft. The FBI discovered that the IP address...