Most hackers do not get caught. The FBI’s Internet Crime Complaint Center logged more than 859,000 cybercrime complaints in 2024, with reported losses above $16 billion, and only a small fraction of those cases ever produce an arrest.1Federal Bureau of Investigation. FBI Releases Annual Internet Crime Report The ones who are identified, though, run into a federal system built to hit hard: prison terms up to 20 years under the main hacking statute, fines that can reach $250,000 or more, a mandatory two-year add-on for stealing personal data, and civil lawsuits from the people they hacked.
Why Most Hackers Aren’t Caught
The low prosecution rate isn’t a mystery. Investigators face obstacles that don’t exist with most other crimes, and the tools working against them are cheap, legal, and widely available.
Anonymity technology is the first wall. Virtual private networks route traffic through intermediary servers that strip identifying information. The Tor network bounces connections through multiple relays scattered around the world. Cryptocurrency lets a hacker get paid without attaching a real name to the transaction. A hacker using all three leaves a trail that dead-ends in jurisdictions where cooperation with U.S. law enforcement is unlikely.
International borders make that worse. When a hacker operates from a country that has no extradition treaty with the United States, or from one that quietly tolerates cybercrime aimed at foreign targets, federal agents can know exactly who the person is and still have no realistic way to arrest them. Even cooperative countries can take months or years to process a mutual legal assistance request.
Digital evidence also degrades quickly. Server logs get overwritten, temporary files vanish, and cloud infrastructure can be spun up and shut down within hours. A victim who waits weeks to report an intrusion may have already lost the data an investigator would need to trace the attacker.
And then there’s volume. The FBI, Secret Service, and state agencies run specialized cyber units, but with more than 2,000 IC3 complaints a day on average over the past five years, the caseload dwarfs capacity.2Internet Crime Complaint Center. Internet Crime Complaint Center Most reports never receive the kind of intensive forensic work that could lead to an arrest. The Secret Service’s Cyber Investigative Section openly focuses on the most significant networks undermining U.S. financial systems, which means smaller-scale hacking frequently goes unpursued at the federal level.3United States Secret Service. Cyber Investigations
Who Does Get Caught
The cases that make it to prosecution tend to involve large financial losses, critical infrastructure, or national security. Investigations can run for years. They usually begin when a victim reports an intrusion to IC3 or to the Secret Service, and from there digital forensics takes over.
Forensic analysts collect data from compromised systems and reconstruct how an attacker got in, what they touched, and what they took. A documented chain of custody runs through the whole process, because digital evidence has to be authenticated and shown to be free of tampering to be admissible under the Federal Rules of Evidence. IP address tracing is one of the most common techniques: every connected device has a numerical identifier, and investigators work with internet service providers to tie those addresses to subscriber accounts. Network logs and metadata build the timeline.
The hackers who get identified tend to share certain habits. They reuse infrastructure. They make operational security mistakes. They brag. They target organizations with the resources and motivation to push a criminal referral all the way through. Someone who launches an attack against a major corporation through a VPN but then logs into the same server once without the VPN has handed investigators the thread that unravels the entire operation.
Cooperation agreements are common after an arrest. Prosecutors regularly offer reduced sentences to defendants who provide information about larger criminal networks, testify against co-conspirators, or help identify vulnerabilities in government systems. For some defendants, cooperation is the difference between a decade in federal prison and a few years of supervised release.
What Federal Law Covers
The Computer Fraud and Abuse Act, codified at 18 U.S.C. § 1030, is the primary federal statute used to prosecute hackers. It criminalizes unauthorized access to “protected computers,” a category that includes any computer used in interstate or foreign commerce. Because virtually every internet-connected device qualifies, the CFAA’s reach is enormous.4Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
The law reaches breaking in to steal information, accessing a system to commit fraud, intentionally damaging a computer with malicious code, trafficking in stolen passwords, and using computer access to extort someone. Government systems and financial institution computers get heightened protection with steeper penalties. Prosecutors frequently stack CFAA charges with other federal statutes, and all 50 states have their own computer crime laws, so a single intrusion can produce both federal and state charges.5National Conference of State Legislatures. Computer Crime Statutes
Prison Time and Fines If Convicted
CFAA maximum sentences scale with the type of offense and whether it’s a first or repeat conviction.4Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
- Basic unauthorized access or trespassing on a government computer: up to 1 year for a first offense (misdemeanor), up to 10 years on a second conviction.
- Unauthorized access for financial gain or to further another crime: up to 5 years for a first offense, 10 years for a repeat.
- Computer fraud: up to 5 years for a first offense, 10 years for a subsequent one.
- Intentionally damaging a computer through malicious code or other means: up to 5 years for a first offense, 10 years for a repeat.
- Obtaining national security information: up to 10 years for a first offense, up to 20 years for a second conviction.
- Extortion involving computer access: up to 5 years for a first offense, 10 years for a second.
If intentional damage to a computer causes or contributes to someone’s death, the maximum sentence is life in prison.
Fines are governed by 18 U.S.C. § 3571, the general federal sentencing statute. For an individual convicted of a CFAA felony, the maximum is $250,000. For a misdemeanor, up to $100,000. A separate provision lets a court impose a fine equal to twice the gross gain to the hacker or twice the gross loss to the victim, whichever is greater, which in a large data breach can push the number well beyond $250,000.6Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine
The Mandatory Add-On for Identity Theft
Hackers who steal personal information during a breach usually pick up a second charge: aggravated identity theft under 18 U.S.C. § 1028A. It imposes a mandatory two-year prison sentence that runs consecutively with any other sentence. The court cannot reduce the underlying hacking sentence to offset it, cannot run the two years concurrently, and cannot substitute probation.7Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft A defendant sentenced to five years for computer fraud who also stole personal data will serve at least seven.
Collateral Consequences
A federal hacking conviction follows a person well beyond the sentence. A felony record disqualifies you from many jobs in technology, finance, and government. Courts routinely order restitution to compensate victims for actual losses from the breach. Probation conditions often include restrictions on computer use, which can effectively end a career in IT or software development.
Civil Lawsuits From Victims
Criminal prosecution is not the only legal risk. The CFAA includes a private right of action that lets victims sue hackers directly for compensatory damages and injunctive relief. The victim has to show at least $5,000 in losses during a one-year period, among other qualifying factors, and the statute of limitations is two years from the date the damage is discovered.4Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
Victims can also bring common-law claims. Courts have accepted that unauthorized access to a computer system can support a trespass claim, where the plaintiff argues the hacker interfered with their use of the system or damaged stored data. Companies whose trade secrets are stolen often add a misappropriation claim. These suits can proceed whether or not the government files criminal charges, and the burden of proof in a civil case is lower than in a criminal one.
Security Researchers Are Not the Target
Not everyone probing a computer system is a criminal, and the CFAA’s reach has historically made that line uncomfortably blurry. In May 2022, the Department of Justice revised its internal charging policy to tell federal prosecutors to decline CFAA cases where the evidence shows good-faith security research: accessing a computer solely to test or fix a security flaw, in a way designed to avoid harm, with the information used to improve the security of the affected systems. The policy also says prosecutors should not bring “exceeds authorized access” charges based solely on a violation of a website’s terms of service or a company’s computer use policy.8Department of Justice. 9-48.000 – Computer Fraud and Abuse Act
Many companies also run bug bounty programs that authorize testing within defined boundaries, creating a contractual safe harbor as long as the researcher follows the rules. The DOJ policy is an internal guideline rather than a legal defense, and anyone who causes real harm, acts in bad faith, or steps outside the scope of an authorization still faces full CFAA liability.
The honest picture is this. Most cybercrimes go unpunished because volume overwhelms enforcement and anonymity tools stop most investigations cold. But the hackers who are identified walk into a system designed to impose serious consequences, and a single conviction can mean years in federal prison, hundreds of thousands of dollars in fines, restitution to victims, and a permanent record.