Court Filing Reveals Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker

U.S. prosecutors have linked an alleged Scattered Spider hacker, Peter Stokes, to a luxury jewelry retailer breach through a persistent Windows device ID. Stokes, a dual U.S.-Estonian citizen, was extradited from Finland and faces charges of conspiracy, computer intrusion, and fraud. The attackers gained access by impersonating locked-out employees and resetting accounts via phone calls, installing tunneling tools, and exfiltrating 77GB of data. Despite attempts to deploy ransomware, the retailer’s security team blocked it, and the attackers subsequently sent a ransom email. Investigators believe Scattered Spider is not a single group, but a network of independent cells, making arrests unlikely to significantly curb the broader threat. Several recent prosecutions have involved individual arrests linked to the same playbook, with seized hardware potentially holding more value than the convictions themselves.