A cybercrime case revealed how Microsoft records can link a Windows device identifier to online activity. Here’s what this means for your privacy and safety on Windows devices right now.
Table of Contents
What Happened?
The case involves Peter Stokes, 19, who faces U.S. charges tied to the Scattered Spider hacking group.
The complaint says investigators used a Microsoft Global Device Identifier, or GDID, while examining a May 2025 attack on a luxury jewelry retailer.
A GDID is a unique number tied to a Windows installation on a device. It can stay the same across normal Windows updates.
The records showed that the same device identifier appeared alongside specific internet activity, websites, and timestamps.
That matters because your online activity can leave more traces than you may realize. A VPN may hide your usual internet address, but other device signals can still create a longer digital trail.
Your personal information may also already appear in data breaches or data leaks you do not know about.
If you are not sure whether your information was leaked somewhere, automatic monitoring can help you spot problems earlier.
Futureproof monitors your data for leaks 24/7 and helps you reduce scam risks with simple, clear steps.
Who Was Affected and What Data Was Leaked?
The complaint does not describe a broad leak of Windows users’ data. The Microsoft records discussed in the case focused on one device tied to Stokes.
Those records linked the GDID to internet addresses and visits to certain webpages. The complaint does not say how many Windows users have similar records.
The luxury jewelry retailer was a separate victim in the cyberattack. The complaint says criminals stole at least 77 gigabytes of company data.
However, the retailer’s name and the full list of affected people were not shared publicly.
This case does not show that your Windows data was leaked. Still, it shows how much information can be connected to one device over time.
Separately, personal information stolen in other breaches can help criminals create convincing phishing emails, fake calls, or identity theft attempts.
Futureproof monitors your information for data leaks 24/7 and guides you with clear steps to keep it safer from scams.
Run a free checkHow Microsoft Records Linked a Windows Device to Online Activity
Investigators did not rely on the GDID alone. The complaint says the device used a VPN, which routes your internet traffic through another server.
On May 12, 2025, Microsoft records showed the same GDID visiting the ngrok signup page. Ngrok is a tool that creates secure connections between computers and online services.
The records also connected the device to servers run by Tzulo, a hosting provider. Investigators compared that activity with records from other providers and accounts.
The complaint says the same GDID appeared across different locations and times. That helped investigators connect the device to accounts and activity linked to Stokes.
A Windows reinstall creates a new GDID, according to the complaint. Normal Windows updates do not change it.
PCMag found no easy opt-out in public guidance. Microsoft documentation calls the Global Device ID an internal identifier but does not explain the use described here.
At Futureproof, Kevin explains digital safety in simple words, with clear tips and zero fluff. He holds a degree in information technology and studies fraud trends to keep his tips up-to-date.
In his free time, Kevin plays with his cat, enjoys board-game nights, and hunts for New York’s best cinnamon rolls.
