Windows Device ID Helped FBI Trace Alleged Scattered Spider Hacker in Jewelry Retailer Breach

U.S. prosecutors have linked an alleged member of the Scattered Spider cybercriminal group to a May 2025 intrusion at a luxury jewelry retailer using a persistent Windows device identifier, according to a newly unsealed federal complaint. The suspect, 19-year-old Peter Stokes, a dual U.S.-Estonian citizen known online as “Bouquet,” was extradited from Finland and made his first court appearance in Chicago on June 30, 2026. He is charged with conspiracy, computer intrusion, and fraud, and is presumed innocent pending trial.

Between May 12 and 15, 2025, attackers called the retailer’s IT help desk using Google Voice numbers, impersonated locked-out employees, and convinced staff to reset passwords and multifactor authentication devices. Within hours, they controlled three accounts, including two belonging to IT administrators. They installed tunneling tools ngrok and Teleport, exfiltrated at least 77 gigabytes of data to Amazon cloud storage, and attempted to deploy ransomware. The retailer’s security team blocked the ransomware and evicted the attackers, but the breach cost approximately $2 million in disruption, investigation, and cleanup. The attackers demanded $8 million in cryptocurrency but were not paid.

Microsoft provided the FBI with a Global Device Identifier (g:6755467234350028) tied to the Windows device used to create the ngrok account. The device visited the ngrok signup page at 19:21 UTC on May 12, 2025, the same minute the account was created, and later accessed the retailer’s website through the same proxy. The device also matched IP addresses used for Snapchat, Apple, and Facebook accounts attributed to Stokes, aligning with his travel records from Tallinn, New York, and Thailand.

Research from Group-IB suggests Scattered Spider is not a single group but a loose collective of small, independent cells, making arrests less effective at dismantling the overall threat. Other recent prosecutions include Tyler Buchanan’s guilty plea in April 2026 and Noah Urban’s 10-year sentence in 2025. Finnish police seized two 2-terabyte hard drives from Stokes, which may contain valuable intelligence on the group’s infrastructure.