FBI and Microsoft Track Windows Devices Using Hidden Global Device ID, Leading to Hacker Arrest
On July 1, the FBI extradited a 19-year-old Estonian-American suspect from Finland to the U.S., linking him to the cybercriminal group Scattered Spider. The arrest revealed a previously undisclosed tracking mechanism in Windows: a Global Device ID (GDID), a persistent, unique identifier assigned to every Windows installation whether on physical hardware or a virtual machine.
Microsoft provided the GDID to authorities, enabling them to trace the suspect’s device despite his use of a VPN. The identifier remains unchanged even after system updates but resets upon a full Windows reinstallation. According to court documents, the GDID helped connect the hacker to a May 2025 breach of a luxury jewelry retailer, where he exploited web development tools and platforms like ngrok to bypass security measures.
The case has raised privacy concerns, as Microsoft’s ability to link GDIDs to user activity including browsing history, gaming sessions, and social media logins suggests a level of surveillance beyond traditional tracking methods. Cybersecurity expert Matthew Hickey criticized Windows as "surveillance software," while researcher Costin Raiu noted that achieving true anonymity may require open-source alternatives like Linux, combined with VPNs or proxies.
Microsoft has not publicly addressed the implications of the GDID, which is only briefly mentioned in its support documentation. While reinstalling Windows generates a new identifier, other digital footprints such as IP addresses or behavioral patterns could still allow authorities to correlate multiple GDIDs to a single user.
Microsoft cybersecurity rating report: https://www.rankiteo.com/company/microsoft
"id": "MIC1783527840",
"linkid": "microsoft",
"type": "Vulnerability",
"date": "5/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Luxury Goods',
'name': 'Luxury jewelry retailer (unnamed)',
'type': 'Retailer'}],
'attack_vector': 'Exploitation of web development tools and platforms (e.g., '
'ngrok)',
'date_detected': '2025-05-01',
'date_publicly_disclosed': '2025-07-01',
'description': 'On July 1, the FBI extradited a 19-year-old Estonian-American '
'suspect from Finland to the U.S., linking him to the '
'cybercriminal group *Scattered Spider*. The arrest revealed a '
'previously undisclosed tracking mechanism in Windows: a '
'Global Device ID (GDID), a persistent, unique identifier '
'assigned to every Windows installation. Microsoft provided '
'the GDID to authorities, enabling them to trace the suspect’s '
'device despite his use of a VPN. The identifier helped '
'connect the hacker to a May 2025 breach of a luxury jewelry '
'retailer, where he exploited web development tools and '
'platforms like *ngrok* to bypass security measures.',
'initial_access_broker': {'entry_point': 'Web development tools and platforms '
'(e.g., ngrok)'},
'investigation_status': 'Ongoing',
'lessons_learned': 'The incident highlights the privacy implications of '
"persistent device identifiers like Microsoft's Global "
'Device ID (GDID), which can be used to track users even '
'when employing VPNs. True anonymity may require '
'open-source alternatives like Linux combined with VPNs or '
'proxies.',
'motivation': 'Financial gain',
'post_incident_analysis': {'root_causes': 'Exploitation of persistent device '
'identifiers (GDID) and weak '
'security measures in web '
'development tools.'},
'recommendations': ['Consider using open-source operating systems like Linux '
'for enhanced privacy.',
'Combine VPNs or proxies with other anonymity tools to '
'reduce tracking risks.',
'Reinstall Windows to reset the GDID if privacy is a '
'concern.'],
'references': [{'source': 'Court documents'},
{'source': 'Cybersecurity expert Matthew Hickey'},
{'source': 'Researcher Costin Raiu'}],
'response': {'law_enforcement_notified': 'Yes',
'third_party_assistance': 'FBI, Microsoft'},
'threat_actor': 'Scattered Spider',
'title': 'FBI and Microsoft Track Windows Devices Using Hidden Global Device '
'ID, Leading to Hacker Arrest',
'type': 'Data Breach'}