E. Martin Estrada, U.S. Attorney | U.S. Attorney's Office for the Central District of California
A Santa Clarita resident, Ryan Mitchell Kramer, has agreed to plead guilty to charges related to hacking into a Disney employee's personal computer and illegally downloading confidential company data. The 25-year-old has been charged with "one count of accessing a computer and obtaining information and one count of threatening to damage a protected computer."
This legal matter emerges from events that occurred in early 2024 when Kramer distributed a computer program online that was falsely advertised as a tool for creating A.I.-generated art. The program, shared on platforms such as GitHub, contained a malicious file allowing Kramer unauthorized access to the computers of individuals who downloaded it.
In a specific incident between April and May 2024, Kramer accessed the private computer of a Disney employee, retrieving login credentials linked to their personal and professional accounts. This access extended to a Slack account utilized by the Disney employee in their professional capacity. Using these credentials, Kramer downloaded approximately 1.1 terabytes of confidential data from Disney's Slack channels.
The situation escalated in July 2024 when Kramer contacted the Disney employee via email and Discord, masquerading as part of a fictitious Russian hacktivist group named "NullBulge." Kramer issued threats to release the sensitive data unless certain actions were taken. When the employee did not respond, the data was released publicly on various online platforms by July 12, 2024. This included not only Disney’s data but also the personal information of the employee, comprising bank and medical records.
Kramer's plea agreement also reveals that at least two other individuals downloaded the compromised file, allowing Kramer to access their computers and accounts without authorization.
The FBI's ongoing investigation is spearheading efforts in this case, while legal proceedings are handled by Assistant United States Attorneys Lauren Restrepo and Maxwell Coll from the Cyber and Intellectual Property Crimes Section. Kramer's initial court appearance is anticipated to take place soon at the United States District Court in Los Angeles.
