Austin Alcala is a former member of the Xbox Underground, an international hacking ring that stole an estimated $100 million to $200 million in intellectual property from Microsoft, major game studios, and a U.S. Army contractor between 2011 and 2014. A teenager from McCordsville, Indiana, when he took part, Alcala pleaded guilty in federal court in Delaware to conspiracy to commit computer intrusions and criminal copyright infringement, and in April 2016 he was sentenced to three years of supervised release with no prison time.1IndyStar. Indiana Hacker Sentenced in $100 Million Scheme
What Alcala Did Inside the Group
Alcala went by the handle “AAMonkey” and was a senior at Hamilton Southeastern High School in Fishers, Indiana, during the conspiracy. According to the FBI, he hacked into Microsoft and Zombie Studios and stole login credentials from both, then passed a database file containing roughly 11,266 stolen credentials to his co-conspirators.2FBI. Fourth Member of International Computer Hacking Ring Pleads Guilty Those credentials were the kind of access the ring used to move deeper into corporate networks.
What Xbox Underground Stole
The group operated from about January 2011 through March 2014, using SQL injection attacks and stolen employee logins to get inside Microsoft, Epic Games, Valve Corporation, and Zombie Studios, a Seattle developer that had built training software for the U.S. Army.3U.S. Department of Justice. Four Members of International Computer Hacking Ring Indicted for Stealing Gaming Technology and Apache Helicopter Software4NPR. U.S. Charges Four Hackers for Stealing Games From Microsoft, Army
Once inside, the hackers took unreleased software, source code, trade secrets, and financial data. Among the items were the source code and technical specifications for Microsoft’s then-unreleased Xbox One, pre-release copies of “Gears of War 3” and “Call of Duty: Modern Warfare 3,” and proprietary Apache helicopter flight simulator software built for the Army.3U.S. Department of Justice. Four Members of International Computer Hacking Ring Indicted for Stealing Gaming Technology and Apache Helicopter Software From Zombie Studios, the group also pulled employees’ Social Security numbers, home addresses, and tax documents, and tried to use that information to open fraudulent credit card accounts.5Kotaku. Hackers Charged With Stealing From Valve, Microsoft, and the U.S. Army
Members also assembled counterfeit Xbox One development kits using pre-release versions of the operating system. One sold on eBay for $5,000 in August 2012, more than a year before the console’s retail launch. A second, arranged for a buyer in Seychelles, was intercepted by the FBI before shipment.6BBC. Hackers ‘Built Counterfeit Xbox One Development Kit’
Arrest, Charges, and Guilty Plea
FBI agents arrived at Alcala’s parents’ home in McCordsville at 5:45 a.m. in January 2014 to arrest him. He was 18.7IndyStar. Former Xbox Underground Hacker Tries to Make Good in Cybersecurity On April 23, 2014, a federal grand jury in the District of Delaware returned an 18-count superseding indictment against Alcala and three co-defendants: Nathan Leroux of Bowie, Maryland; Sanadodeh Nesheiwat of Washington, New Jersey; and David Pokora of Mississauga, Ontario. The charges included conspiracies to commit computer fraud, copyright infringement, wire fraud, mail fraud, identity theft, and theft of trade secrets, plus individual counts of aggravated identity theft, unauthorized computer access, copyright infringement, and wire fraud.8U.S. Department of Justice. Four Members of International Computer Hacking Ring Indicted for Stealing Gaming Technology
Alcala was the last of the four U.S.-indicted defendants to plead. Pokora and Nesheiwat pleaded guilty on September 30, 2014; Leroux followed on January 20, 2015.2FBI. Fourth Member of International Computer Hacking Ring Pleads Guilty Alcala entered his plea in early April 2015 to a single count of conspiracy to commit computer intrusions and criminal copyright infringement.9The Hill. Indiana Teen Pleads Guilty to Hacking Conspiracy
The Sentence and How It Compared
On April 19, 2016, U.S. District Judge Gregory M. Sleet sentenced Alcala to three years of supervised release with no prison time. Alcala was 20 at sentencing.10WDEL. Defendant in Computer Hacking Case Sentenced to Probation
His co-defendants fared differently. Pokora, described by prosecutors as the first foreign national ever convicted in the United States for hacking to steal trade secrets, received 18 months in federal prison followed by three years of supervised release. Judge Sleet said at that hearing he had weighed deterrence against Pokora’s remorse and future potential.11Delaware Online. Judge Sentences Foreign Hacker for First Time Ever in U.S. Investigators seized more than $620,000 in cash and proceeds over the course of the case.3U.S. Department of Justice. Four Members of International Computer Hacking Ring Indicted for Stealing Gaming Technology and Apache Helicopter Software
Where Alcala Is Now
A 2021 IndyStar profile reported that Alcala, after completing his sentence, was working to redirect his skills into legitimate cybersecurity.7IndyStar. Former Xbox Underground Hacker Tries to Make Good in Cybersecurity