Hacker arrest exposes Microsoft's Windows device ID tracking capabilities
What's the story
The recent arrest of a teenage hacker has raised alarms about Microsoft's potential surveillance capabilities. The hacker, 19-year-old Peter Stokes, was extradited from Europe for allegedly being part of the infamous hacking group Scattered Spider. What makes this case particularly interesting is that Microsoft helped link Stokes to the alleged hacking activities using a "Global Device ID" (GDID) associated with his Windows PC.
Tracking method
Stokes allegedly hacked a jewelry retailer while using VPN
Stokes reportedly hacked a luxury jewelry retailer in May 2025 while using a VPN. However, the FBI was able to trace him back through Microsoft records linking his IP address with the company's device identifier, GDID. The unsealed criminal complaint explains that "a Global Device Identifier in the Windows ecosystem is a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device."
Privacy fears
Microsoft can link GDID with 3rd-party services
The revelation that Microsoft can link GDID with third-party services has raised privacy concerns. It implies the tech giant could potentially track a user's online activity without relying on third-party browser cookies. The complaint also details how Stokes exploited a web development tool, ngrok, to circumvent the jewelry retailer's network defenses. On May 12, 2025, Microsoft's records show that the GDID linked to Stokes's computer accessed multiple ngrok pages including one for setting up an account.
Identifier details
'Microsoft Windows is surveillance software'
The complaint also notes that Microsoft's records showed the GDID accessing "multiple sites" from servers at Tzulo, a web hosting provider, to execute the hack. The specific identifier for Stokes's PC was 6755467234350028. This case has sparked fears of abuse for other surveillance purposes, with cybersecurity expert Matthew Hickey even alleging in a tweet that "Microsoft Windows is surveillance software."
User control
Can users reset their GDID?
Despite the concerns, Microsoft has remained silent on the matter. The company does mention the device ID briefly on a support page but hasn't made any public statements about it. According to the criminal complaint, a Windows user can reset their GDID themselves, albeit with some difficulty. The court document states "a GDID remains consistent across Windows operating system updates on a device," but "a reinstall of Windows...will be tied to a new unique GDID."