Disney Hacker Sentenced to Prison Time

Ryan Mitchell Kramer, a 25-year-old from Santa Clarita, was sentenced on May 15 to 15 months in federal prison for hacking a Disney employee’s personal computer and using stolen credentials to pull confidential company data from Disney’s internal Slack system. Federal prosecutors said Kramer downloaded about 1.1 terabytes of material from thousands of Slack channels tied to the Burbank-based entertainment company. The case stems from a 2024 intrusion that prosecutors said began with malware disguised as an artificial-intelligence art tool. Kramer had agreed in May 2025 to plead guilty to two felony counts in Los Angeles federal court. ### How did prosecutors say Kramer got into Disney’s systems? The U.S. Attorney’s Office for the Central District of California said Kramer posted a computer program on online platforms including GitHub in early 2024 and presented it as software for creating AI-generated art. Prosecutors said the program actually contained a malicious file that let him gain access to victims’ computers. (mynewsla.com) April and May 2024 are when the Disney employee downloaded the malicious file, according to Kramer’s plea agreement described by prosecutors. The Justice Department said that access gave Kramer entry to the victim’s personal computer and to an online account where the employee stored login credentials and passwords for personal and work accounts. (justice.gov) ### What did he take once he had the employee’s credentials? May 2024 is when Kramer used the employee’s credentials to access a Slack account the victim used as a Disney employee, prosecutors said. The Justice Department said he then gained access to non-public Disney Slack channels and downloaded approximately 1.1 terabytes of confidential data from thousands of those channels. (justice.gov) Court records described in the charging documents said the information he obtained included non-public records, communications and other internal Disney material valued at more than $5,000. Other reporting on the case said the leaked material included internal files and messages from a broad swath of Disney operations. ### Why does the name “NullBulge” appear in the case? (justice.gov) July 2024 is when prosecutors said Kramer contacted the Disney employee by email and on Discord while pretending to be part of a fake Russia-based hacktivist group called “NullBulge.” The messages threatened to leak both the employee’s personal information and Disney’s Slack data, according to the Justice Department. (regmedia.co.uk) July 12, 2024, is when prosecutors said Kramer carried out that threat after the employee did not respond. The Justice Department said he publicly released the stolen Disney Slack files and also posted the victim’s bank, medical and personal information on multiple online platforms. ### What charges did Kramer admit to? (justice.gov) May 1, 2025, is when federal prosecutors announced that Kramer had agreed to plead guilty to one count of accessing a computer and obtaining information and one count of threatening to damage a protected computer. Each count carried a statutory maximum sentence of five years in prison, prosecutors said at the time. (justice.gov) Los Angeles federal court handled the case under U.S. District Judge Andre Birotte Jr., according to the public docket. The sentencing reported on May 15 followed Kramer’s earlier guilty plea in the Central District of California. ### What is the next concrete step in the case? The Justice Department’s May 15 announcement of Kramer’s sentence is the latest public milestone identified in the case materials available through federal prosecutors and the court docket. (justice.gov) The public docket in United States v. Kramer remained available through CourtListener as of May 7, 2026, and the U.S. Attorney’s Office for the Central District of California has published the plea announcement tied to the case. (courtlistener.com)