Cloud Account Hacking Prosecutions
1. United States v. Paige A. Thompson (Capital One Data Breach, 2019)
Court: U.S. District Court, Western District of Washington
Background: Paige Thompson, a former Amazon Web Services (AWS) engineer, exploited a misconfigured firewall on Capital One’s AWS cloud infrastructure. She gained unauthorized access to over 100 million customer records, including credit card applications and social security numbers.
Charges:
Computer Fraud and Abuse Act (CFAA) violations
Wire fraud
Accessing a protected computer without authorization
Legal Reasoning:
Thompson used her insider knowledge of AWS to exploit Capital One’s cloud storage (S3 buckets) via a misconfigured web application firewall. Prosecutors proved that she not only accessed data but also attempted to share and brag about it online in Slack channels.
Outcome:
She was found guilty in 2022 and sentenced to time served and supervised release, but the conviction confirmed that misusing cloud access tools equals unauthorized access under CFAA.
Key Precedent:
Demonstrated that even exploiting a misconfiguration in a cloud service constitutes criminal hacking if the actor lacks permission.
2. United States v. Lauri Love (U.S. Government Cloud Servers Hack, 2013)
Court: U.S. District Courts (New Jersey, Virginia, New York)
Background: British activist Lauri Love allegedly hacked into U.S. government cloud-hosted servers (FBI, NASA, U.S. Army) using a vulnerability in Adobe ColdFusion software. The systems were hosted on government cloud infrastructure.
Charges:
Accessing protected computers without authorization
Theft of data from U.S. agencies
Legal Reasoning:
Love and his co-conspirators installed backdoors, exfiltrated sensitive data, and defaced servers. They used proxy networks to conceal their identities.
The U.S. requested extradition, but the U.K. High Court blocked it on humanitarian grounds (mental health concerns).
Outcome:
While Love wasn’t extradited, the case remains pivotal for defining cross-border jurisdiction in cloud-related hacking.
Key Precedent:
This case clarified that hacking cloud-hosted U.S. data, even from another country, falls under U.S. jurisdiction if federal systems are involved.
3. United States v. Justin Liverman and Andrew Otto Boggs (Crackas with Attitude Group, 2015)
Court: U.S. District Court for the Eastern District of Virginia
Background: The hacking group "Crackas with Attitude" infiltrated cloud-based accounts belonging to high-ranking U.S. officials, including the CIA Director and FBI Deputy Director.
They gained access via social engineering and password resets through cloud email systems like Gmail and AOL.
Charges:
Unauthorized access to government computer systems
Aggravated identity theft
Conspiracy to commit computer intrusions
Legal Reasoning:
They used publicly available data to reset security questions on officials’ email and cloud accounts, accessing confidential communications and cloud storage.
Outcome:
Boggs received 2 years, and Liverman 5 years imprisonment.
Key Precedent:
This case emphasized that social engineering methods leading to cloud account breaches are criminal intrusions under CFAA, even without traditional “hacking tools.”
4. United States v. Roman Seleznev (POS Data Stored in Cloud Servers, 2011–2014)
Court: U.S. District Court, Western District of Washington
Background: Russian national Roman Seleznev hacked into numerous U.S. businesses, stealing millions of credit card details and storing stolen data in cloud-based servers.
Charges:
Computer fraud
Wire fraud
Identity theft
Legal Reasoning:
Seleznev managed a complex cybercrime infrastructure using cloud servers to store and distribute stolen data. The FBI traced multiple servers used for illegal data trade and laundering.
Outcome:
Convicted and sentenced to 27 years in prison—one of the harshest cybercrime sentences in U.S. history.
Key Precedent:
Set a strong deterrent example that using cloud infrastructure to host or distribute hacked data multiplies liability, as each use of the cloud is treated as a distinct unlawful act.
5. United States v. Grant West (UK “Courvoisier” Case, 2017)
Court: Southwark Crown Court, London (cooperating with U.S. authorities)
Background: Grant West conducted phishing attacks to steal data from companies like Uber and Sainsbury’s. He stored stolen data and cryptocurrency profits on cloud accounts (Dropbox, iCloud).
Charges:
Computer misuse
Identity theft
Money laundering
Legal Reasoning:
West’s arrest led to seizure of encrypted cloud accounts containing personal data and stolen credentials. The prosecution argued that cloud storage was part of the criminal infrastructure.
Outcome:
Sentenced to 10 years and 8 months imprisonment.
Key Precedent:
Clarified that cloud accounts used to store or manage stolen digital assets are part of the criminal operation, and can be seized or forfeited under law.
6. United States v. Ryan Collins (Celebrity iCloud Photo Leak, “The Fappening,” 2014)
Court: U.S. District Court, Middle District of Pennsylvania
Background: Ryan Collins illegally accessed over 100 iCloud and Gmail accounts of celebrities, stealing private photos. He used phishing emails that mimicked Apple and Google login pages.
Charges:
Unauthorized access to protected computers
Identity theft
Legal Reasoning:
The court held that phishing users’ cloud login credentials is equivalent to direct unauthorized access to a computer under the CFAA.
Outcome:
Sentenced to 18 months imprisonment.
Key Precedent:
Established that phishing to gain entry into cloud-based accounts (like iCloud or Gmail) is prosecutable under CFAA as hacking, even without direct system intrusion.
7. United States v. Alonzo Knowles (The Hollywood Hacker, 2015)
Court: U.S. District Court, Southern District of New York
Background: Knowles hacked celebrity cloud email and Dropbox accounts to steal scripts, unreleased music, and personal data, offering them for sale.
Charges:
Computer fraud
Identity theft
Wire fraud
Legal Reasoning:
He used credential stuffing techniques to access multiple cloud accounts, which the court found to be a direct violation of the CFAA.
Outcome:
Sentenced to 5 years imprisonment.
Key Precedent:
Confirmed that commercial exploitation of hacked cloud content adds aggravating factors—raising sentencing severity.
8. United States v. Edward Majerczyk (Co-Conspirator in iCloud Hacks, 2014)
Court: U.S. District Court, Northern District of Illinois
Background: Majerczyk, another participant in the 2014 celebrity iCloud photo leaks, sent fake “security alert” emails to victims to steal their iCloud credentials.
Charges:
Unauthorized computer access
Outcome:
Sentenced to 9 months imprisonment.
Key Precedent:
Supported the same legal principle as Ryan Collins — that credential phishing for cloud access falls squarely within CFAA’s “unauthorized access” provisions.
Legal Takeaways
Cloud data = protected computer systems. Courts consistently hold that cloud storage and accounts (iCloud, Google Drive, AWS, etc.) are “protected computers” under the Computer Fraud and Abuse Act (CFAA).
Social engineering = hacking. Even phishing or password reset abuse qualifies as illegal access.
Cloud storage as a crime facilitator. Using the cloud to host stolen data, or to distribute malware, counts as continued criminal conduct.
Cross-border prosecution applies. Even hackers outside the U.S. can face charges if the cloud servers or data belong to U.S. entities.
Severe penalties. Sentences range from 1 to 27 years depending on intent, scale, and exploitation of cloud systems.
RELATED Blog
0 comments