complaint Archives

Winsage

July 12, 2026

Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing

Microsoft has confirmed the existence of the Global Device Identifier (GDID), a unique identifier assigned to Windows installations, in a federal complaint against an alleged member of the Scattered Spider hacking group. The GDID is generated when a Windows system is set up with a Microsoft Account and remains active through various Windows updates. Disabling the GDID could disrupt Windows activation and access to Microsoft Store applications. The GDID is described as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device." It is created during the provisioning of Windows with a Microsoft Account and is stored in the Windows registry under HKCUSOFTWAREMicrosoftIdentityCRLExtendedProperties. The GDID remains persistent through Windows updates but is not retained after a clean reinstall. A single user can possess multiple GDIDs linked through their account, OneDrive, and activation history. The FBI used the GDID to track Peter Stokes, an alleged member of the Scattered Spider group, across various VPN connections and proxy servers. The GDID was recorded visiting specific websites and was linked to Stokes's accounts on platforms like Snapchat and Facebook. Concerns have been raised regarding user privacy, as the GDID is assigned without user consent and cannot be disabled without compromising essential Windows features. Microsoft has not committed to providing user-facing controls or comprehensive documentation for everyday users regarding the GDID. Legal requests can compel Microsoft to disclose GDID activity data to law enforcement. The GDID is linked to the Microsoft Account rather than the device itself, meaning reinstalling the operating system does not sever this connection.

Winsage

July 11, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes allegedly used sophisticated methods to obscure his identity during a breach at a luxury retailer, but the FBI uncovered his identity through a Global Device Identifier (GDID) linked to his Windows installation. GDID is a persistent device-level identifier that uniquely identifies a Windows installation and remains unchanged through operating system updates, only resetting upon complete reinstallation. Users cannot disable GDID, and attempts to remove it may disrupt Windows activation. To minimize data associated with GDID, users can opt for a local account, limit diagnostic telemetry, disable Activity history, and be cautious during reinstallation. VPNs do not prevent Microsoft from logging GDID, IP addresses, and URLs, making them ineffective for privacy on Windows. GDID has been described as a covert tracking beacon, and security experts advise against using Windows for sensitive tasks, suggesting alternatives like Linux.

Winsage

July 10, 2026

A hacker’s arrest just revealed how Microsoft can track your Windows device

A teenager named Peter Stokes is facing federal charges in Chicago for allegedly hacking a U.S. jewelry retailer while using a VPN to conceal his online activities. Microsoft provided the FBI with data linked to a tracking mechanism called the Global Device Identifier (GDID), which is a unique number assigned to every Windows installation that persists through updates. This identifier allowed authorities to connect Stokes' computer to specific websites, despite his VPN usage. Stokes was arrested in Helsinki in April 2026 while trying to board a flight to Japan, carrying two two-terabyte hard drives. The GDID enabled Microsoft to track Stokes' activities on third-party services, raising concerns about privacy and data tracking.

Winsage

July 10, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes is involved in a breach with a luxury retailer, using tactics like VPNs and rotating IP addresses to hide his digital activity. The FBI discovered a Global Device Identifier (GDID) linked to his Windows installation, which is a persistent device-level identifier that uniquely identifies Windows installations. GDID remains unchanged through operating system updates but resets with a full reinstallation. Disabling GDID is not possible, as attempts to do so would disrupt Windows activation. Users can minimize data linked to GDID by using a local account, reducing diagnostic telemetry, disabling Activity history, and carefully managing reinstalls. VPNs do not prevent Microsoft from logging GDID, IP address, and URL data. Privacy researchers view GDID as a covert tracking mechanism, and Windows lacks user-facing options to reset this identifier, unlike Apple and Google.

Winsage

July 10, 2026

You can’t fully disable Microsoft’s GDID Windows 11 tracker, but these settings limit what it captures

A 19-year-old named Peter Stokes was detained at Helsinki airport in April 2026 while traveling to Japan, carrying two 2TB hard drives. He was subject to an Interpol Red Notice and faced a federal complaint from U.S. prosecutors by July for his alleged involvement in the Scattered Spider hacking group, which breached a U.S. luxury jewelry retailer in May 2025, leading to a ransom demand. The Global Device Identifier (GDID), developed by Microsoft, is a persistent identifier that uniquely identifies a Windows installation on a device. It links online activities back to a single identity, which law enforcement can use to trace a device's owner. The GDID is generated when a user signs into Windows with a Microsoft Account and remains through updates but does not survive a clean reinstall. Stokes' use of the same Windows device allowed investigators to trace his activities through the GDID, which linked him to the hacking incident. Privacy advocates have raised concerns about the lack of consent for GDID assignment and the potential for surveillance.

Winsage

July 9, 2026

Windows hides a secret identifier that Microsoft hands over to the FBI

19-year-old Peter Stokes, a member of the Scattered Spider group, was arrested by the FBI due to a unique number embedded in his Windows operating system known as the Global Device Identifier (GDID). This identifier, assigned during Windows installation, remains unchanged and can leak user information despite the use of VPNs. The FBI identified Stokes by obtaining a history of IP addresses linked to his GDID from Microsoft, which allowed them to trace his online activities across various platforms. Microsoft tracks over a billion devices with this permanent identifier, which cannot be disabled.

Winsage

July 7, 2026

Microsoft Windows telemetry identified hacker despite VPN use

Microsoft's telemetry capabilities helped identify Peter Stokes, a 19-year-old suspected member of the Scattered Spider hacking group, despite his use of a VPN. The investigation revealed a significant cybersecurity breach in May 2025 at a luxury jewelry retailer, leading to the theft of approximately 77 GB of sensitive data and a ransom demand. Investigators linked Stokes to the breach through a Global Device Identifier (GDID) associated with a Windows device that created an ngrok account used in the attack. This device accessed various online platforms and shared IP addresses with Stokes' accounts on Apple, Snapchat, and Facebook, corroborated by travel records and social media posts. The evidence included server logs from Scattered Spider's infrastructure and records from ngrok and other providers.

Tech Optimizer

July 2, 2026

How JSON.stringify Corrupted 150,000 Rows in My Postgres Database

A dataset of over 100,000 company profiles was found to have approximately 150,000 corrupted values across ten jsonb columns due to incorrect serialization caused by using JSON.stringify on values intended for jsonb columns. The problematic code was `await sql` update listings set services = ${JSON.stringify(record.services)} where id = ${record.id}`. This resulted in jsonb strings instead of jsonb arrays. The issue was detected by querying the type of the jsonb columns, revealing that two frequently updated columns had around 105,000 and 41,000 corrupted values, respectively. The repair process involved extracting the inner text and re-casting it as valid jsonb, while also addressing complications such as NUL bytes and double-encoding. The correct method for inserting jsonb values is to use `sql.json(record.services)` instead of JSON.stringify. Regular type checks are now part of a daily integrity job to prevent similar issues.

Winsage

June 28, 2026

Microsoft Shares Bounce From 52-Week Low as Italian Probe and Windows 10 Extension Create Crosscurre

The Italian antitrust authority, AGCM, has launched an investigation into Microsoft 365 for allegedly guiding users toward pricier subscription tiers by integrating AI tools like Copilot and Designer without explicit user consent. Microsoft has stated it will cooperate with the investigation. Last year, Australia’s consumer watchdog made a similar complaint regarding hidden costs related to Copilot during contract renewals. Despite this scrutiny, Microsoft shares rose to €327.90, a 5.71% increase, following a shift in investor sentiment towards AI-software firms. Microsoft also extended its Extended Security Updates (ESU) program for Windows 10 until October 2027, allowing users to delay transitioning to Windows 11, which could hinder hardware sales. The stock remains down nearly 19% year-to-date and is trading below key moving averages. The ongoing regulatory investigation and sluggish Windows upgrade cycle present challenges for Microsoft’s growth.

AppWizard

June 14, 2026

Blizzard sues to kill another World of Warcraft private server for ‘large scale, egregious, and ongoing infringement of [its] intellectual property’

Blizzard Entertainment has filed a lawsuit against Project Ascension, a private World of Warcraft server, claiming it operates a substantial business model based on significant infringement of Blizzard's intellectual property. Project Ascension reportedly attracts over a million players and allows in-game item purchases through Donation Points, generating millions for its operators. The server is allegedly hosted on "bulletproof" servers linked to the Russia-based Aeza Group, which has been targeted by the U.S. Department of the Treasury for cybercrime. The Turtle WoW server previously faced similar legal action from Blizzard, and there has been no public response from Project Ascension regarding the lawsuit. Community sentiment appears to be one of resignation towards the situation.