A maximum sentence in a statute, a prosecutor’s sentencing request and the sentence a court imposes are different numbers. Mixing them produces dramatic headlines and a poor understanding of cybercrime cases.

The useful question is narrower: what conduct was established, what offense was involved, and what outcome does the dated record actually support?

TL;DR

  • Cybercrime sentences vary with the offense, jurisdiction and individual case; there is no universal “years for hacking” tariff.
  • GDPR administrative fines are not an EU-wide prison-sentence schedule for hackers.
  • Historical sentences need context when appeals, resentencing or pardons change the outcome.
  • Written scope and careful handling of data are practical foundations for security work. US policy specifically recognizes good-faith research, with important limits.

Correction — September 19, 2026: This article has been substantially revised. The previous version misstated several sentences, confused administrative fines with criminal punishment, and included unsupported cases and quotations. Those claims have been corrected or removed.

The Austin Thompson case illustrates the distinction clearly. The US Department of Justice’s July 2, 2019 sentencing announcement lists a ten-year statutory maximum for the charged computer-damage offense. The sentence actually imposed was 27 months, with $95,000 restitution.

A case summary should preserve four separate fields: the conduct, the charge or conviction, the sentence and its date. Financial orders need their own labels too: a fine, forfeiture and restitution are not interchangeable.

United States: Documented Cases

Austin Thompson: Denial-of-Service Attacks, 2019

Thompson’s case concerned attacks against gaming companies and other targets during 2013–2014. The DOJ record describes disruption of servers and his use of the @DerpTrolling account. It does not describe a conviction for creating a “Derpz Trojan,” as our earlier version claimed.

The defensive lesson is that availability incidents deserve evidence collection even when no theft is apparent. Preserve attack timelines, service-impact records and communications with mitigation providers.

Evaldas Rimasauskas: Business Email Compromise, 2019

On December 19, 2019, Rimasauskas received 60 months in prison after pleading guilty to wire fraud in a scheme that induced two US internet companies to transfer more than $120 million. The DOJ sentencing release describes vendor impersonation, fraudulent payment instructions and forged supporting documents.

The court also ordered two years of supervised release, approximately $49.7 million in forfeiture and $26.5 million in restitution. The source does not support our previous explanation that full restitution and substantial cooperation accounted for the sentence; that explanation has been removed.

For defenders, the attack path points to payment controls as well as email security. Verify changed bank details through an established independent contact and retain the approval trail.

Paige Thompson: Capital One Case and Resentencing

The DOJ’s October 4, 2022 announcement records time served and five years of probation, not five years in prison.

That is not the entire procedural history. Following an appeal, the district court held a resentencing hearing on October 29, 2025. Its November 3 order, reproduced from the court filing, explains its decision to impose a sentence involving supervision and home confinement rather than additional imprisonment. Contemporaneous reporting describes time served, five years of supervised release, three years of home confinement and 250 hours of community service.

These are dated outcomes, not a claim about her present custody status. The case demonstrates why an original sentencing announcement alone can be insufficient for a current summary.

Ross Ulbricht: Historical Sentence and 2025 Pardon

Ulbricht’s Silk Road case cannot accurately be presented as someone currently serving an unchanged life sentence. The official January 21, 2025 pardon warrant granted a full and unconditional pardon. It records the original life terms and additional terms as running concurrently, contradicting the earlier article’s general claim that multiple federal sentences automatically run consecutively.

The case involved several offenses connected to running the marketplace. It should not be used as a generic penalty example for an unauthorized security test.

United Kingdom: Correcting the TalkTalk Sentences

For the November 2018 TalkTalk sentencing, contemporary court reporting records 12 months for Matthew Hanley and eight months for Connor Allsopp. The earlier article incorrectly gave those figures in years.

This example relies on contemporaneous journalism rather than an original judgment linked here. It describes those defendants’ outcomes, not a maximum penalty under the Computer Misuse Act or the sentences of everyone involved in the breach.

European Union: GDPR Fines and Criminal Liability

GDPR Article 83 establishes administrative fines for specified infringements. Depending on the provision, the upper tier can reach €20 million or 4% of the undertaking’s preceding financial year’s worldwide annual turnover, whichever is higher. Other listed infringements fall under the lower €10 million/2% tier.

That is not a rule automatically adding €20 million to a hacker’s prison sentence. Criminal liability for intrusion, fraud, extortion or other conduct depends on applicable national law and the facts. Article 84 addresses other penalties set by member states; the GDPR does not itself supply a single EU-wide prison term for hacking.

When discussing a breach, identify whose liability is at issue: the intruder’s criminal conduct and an organization’s data-protection obligations are distinct questions.

Security Research: Scope and Intent Matter

The US DOJ’s current published CFAA charging policy directs prosecutors to decline prosecution where the evidence establishes good-faith security research. Its definition emphasizes testing or correcting vulnerabilities while avoiding harm and using the findings primarily to improve security. Extortion disguised as research does not qualify.

The policy also expressly states that it creates no enforceable rights. It is a US federal charging policy, not blanket immunity from civil claims, other offenses or other jurisdictions. Conversely, calling every port scan a crime everywhere is an unsupported legal generalization.

For a professional engagement, document the authorized systems, dates, techniques, stop conditions and evidence-handling rules. If an unexpected system or sensitive dataset appears, stop that line of testing and use the agreed escalation channel. A broad technical capability is not a substitute for a clear engagement boundary.

Practical Lessons for Researchers and Responders

Use sentencing records to understand specific cases, not to predict a universal punishment. For security work, maintain a written authorization trail and collect only the evidence needed for the agreed objective.

If your own activity may have crossed a legal boundary, stop further access and obtain advice from qualified counsel. Do not delete logs or destroy potential evidence to conceal what happened. For organizations responding to intrusion, preserve relevant records through the established legal and incident-response process.

Sources