His Windows PC Testified Against Him #cybersecurity #privacy

A 19-year-old alleged Scattered Spider hacking group member was arrested partly due to Microsoft telemetry data. Windows assigns every installation a global device identifier that persists across updates and tracks the device across Microsoft services. The FBI used this identifier to link the suspect's device to specific actions — including visiting a victim company's website and signing up for a service used in a ransomware tunnel — going back four years. Notably, Microsoft proactively profiled the suspect and sent a criminal referral to the FBI in 2024 before any warrant was issued. The case highlights how much persistent data Windows collects on all users, data that exists regardless of VPN or proxy use.