18 U.S.C. § 1030(a)(2)
Unauthorized Access to Obtain Protected Information
Key Facts
- Statutory Citation: 18 U.S.C. § 1030(a)(2).
- Official Offense: Unauthorized Access to Obtain Protected Information.
- Jurisdiction: United States (Federal).
- Correlated across 8 primary case matters in this library.
Prosecutorial Elements in Cyber Cases
Prosecutors must establish that the defendant intentionally accessed a protected computer without authorization or exceeded authorized access, and thereby obtained financial, federal agency, or interstate commercial records.
Statutory Sentencing Exposure
Up to 1 year (misdemeanor) or up to 5 years imprisonment (felony for commercial advantage, private financial gain, or value > $5,000), plus criminal forfeiture and fines under Title 18.
Representative Prosecution Cases (8)
U.S. v. Hladyr, Kolpakov & Iarmak (FIN7 Cybercrime Syndicate)
Prosecution of senior leaders of the FIN7 transnational cybercrime syndicate who hacked into thousands of computer systems across the United States, stealing more than 20 million customer credit card records from restaurants and hospitality chains.
U.S. v. Roman Seleznev (Track2 Point-of-Sale Carding)
Prolific cybercriminal (Track2) who hacked into more than 500 small businesses and restaurants across the United States, stealing millions of credit card numbers and generating tens of millions of dollars in illicit sales on automated carding portals.
U.S. v. Albert Gonzalez (TJX & Heartland Payment Systems)
Mastermind of the largest credit card theft operation in history at the time, hacking TJX Companies, BJ's Wholesale Club, OfficeMax, and Heartland Payment Systems, stealing over 130 million payment cards.
U.S. v. Andrei Tyurin (JPMorgan Chase Data Breach)
Russian hacker who penetrated JPMorgan Chase and eleven other major U.S. financial institutions and media companies, stealing personal data belonging to over 100 million customers to fuel securities pump-and-dump schemes.
U.S. v. Paige Thompson (Capital One Cloud Breach)
Former Seattle cloud engineer who identified misconfigured web application firewalls to gain unauthorized access to Capital One's Amazon Web Services storage buckets, exfiltrating 106 million customer credit card applications.
Operation Cookie Monster (Genesis Market Takedown)
Coordinated multinational takedown of Genesis Market, the world's most prominent illicit broker of stolen digital browser fingerprints, cookies, and compromised account credentials.
U.S. v. Marcus Hutchins (Kronos Banking Malware)
British malware researcher who previously halted the global WannaCry ransomware outbreak charged with authoring the Kronos banking trojan and UPAS kit years earlier as a teenager.
U.S. v. Yevgeniy Nikulin (LinkedIn & Dropbox Breaches)
Russian national who hacked into the corporate networks of LinkedIn, Dropbox, and Formspring, stealing login credentials of over 100 million users and selling the stolen database dumps on darknet forums.