- Peter Stokes, a 19-year-old American-Estonian, was extradited from Finland to the U.S. on hacking charges linked to Scattered Spider.
- An FBI affidavit ties him to an $8 million ransom demand via a Microsoft Global Device Identifier (GDID) that was unmasked despite VPN use.
- Microsoft's cyber security researchers provided the GDID, which is used for diagnostics and abuse detection, after a court order based on ngrok service records.
- The GDID's IP history matched logins to Stokes's Snapchat, Apple, and Facebook accounts in locations like Tallinn, New York, and Thailand.