Santa Clarita man pleads guilty to hacking Disney employee’s computer
A Santa Clarita man pleaded guilty Wednesday to hacking the personal computer of an employee of the Walt Disney Co. last year in order to illegally download confidential data from the Burbank-based company.
Ryan Mitchell Kramer, 25, entered a plea in downtown Los Angeles to federal counts of accessing a computer and obtaining information, and threatening to damage a protected computer. The charges each carry a sentence of up to five years in federal prison, according to the U.S. Attorney’s Office.
Sentencing was scheduled for Sept. 26.
According to his plea agreement, Kramer posted a computer program early last year on various online platforms, including GitHub, that purportedly could be used to create artificial intelligence-generated art. In fact, the program contained a malicious file that enabled Kramer to gain access to victims’ computers, prosecutors said.
Sometime in April and May of 2024, a victim downloaded the malicious file Kramer posted online, giving Kramer access to the victim’s personal computer, including an online account where the victim stored login credentials and passwords for the victim’s personal and work accounts.
After gaining unauthorized access to the victim’s computer and online accounts, Kramer accessed a Slack online communications account that the victim used as a Disney employee, gaining access to non-public Disney Slack channels. In May 2024, Kramer downloaded about 1.1 terabytes of confidential data from thousands of Disney Slack channels, according to the plea agreement.
In July 2024, Kramer contacted the victim via email and the online messaging platform Discord, pretending to be a member of a fake Russia-based hacktivist group called “NullBulge.” The emails and Discord message contained threats to leak the victim’s personal information and Disney data, court papers show.
On July 12, 2024, after the victim did not respond to Kramer’s threats, Kramer publicly released the stolen Disney Slack files, as well as the victim’s bank, medical, and personal information on multiple online platforms, he admitted.
Kramer further admitted in his plea agreement that, in addition to that victim, at least two other victims downloaded Kramer’s malicious file and that Kramer was able to gain unauthorized access to their computers and accounts.