Windows Device Identifier Used to Arrest Scattered Spider Hacking Group Member

Federal court documents allege that Peter Stokes, linked to the criminal group Scattered Spider (aka Octo Tempest/UNC3944/0ktapus), conducted intrusions including a May 2025 compromise of a luxury retailer that led to 77 GB exfiltration and an $8M ransomware/extortion demand. Investigators tied activity to the actor through operational details (voice-phishing, MFA resets, ngrok tunnel, Teleport.sh/Amazon S3) and a Microsoft Global Device Identifier (GDID) that persisted across IPs and travel locations, enabling identification and arrest.