AFP via Getty Images
A habitual Nintendo hacker who started targeting the games manufacturer while still a minor has finally come unstuck. California resident Ryan Hernandez has now pled guilty to computer fraud abuse and to downloading child pornography, discovered by the FBI during its Nintendo investigation.
As part of his plea arrangement, Hernandez will pay a remediation fine of $259,323 to Nintendo and spend three years in jail. The final penalty will be confirmed by the court when he is sentenced in April.
Hernandez was first caught hacking Nintendo back in 2016. While still a minor, he and an associate phished a Nintendo employee for the credentials needed to steal company files. “That stolen information, including pre-release information about the anticipated Nintendo Switch console, was leaked to the public.”
Given his age, the FBI let Hernandez off with a stark warning, reporting that they had spoken to the suspect and his parents and that he had “promised to stop any further malicious activity and confirmed that he understood the consequences of any future hacking.”
But those “malicious activities” started up again in 2018, when Hernandez hacked into multiple Nintendo servers to steal more confidential files relating to the company’s consoles and games. According to the DOJ, Hernandez bragged about his exploits online under the monicker RyanRocks, and also set up a chat forum, “Ryan’s Underground Hangout,” to share information with others about Nintendo’s vulnerabilities and the data that he had stolen.
Last June, agents from the FBI’s Seattle Cyber Task Force raided Hernandez’s home and seized multiple digital devices, finding “thousands of confidential Nintendo files.” The agents also discovered that he had “used the internet to collect more than one thousand videos and images of minors engaged in sexually explicit conduct, stored and sorted in a folder directory he labeled ‘Bad Stuff’.”
Despite the recommended plea terms, the DOJ points out that computer fraud abuse and the possession of child pornography carry statutory maximums of five and 20 years respectively. As such, Hernandez is getting off somewhat lightly. For Nintendo, though, this will be a welcome warning to others who might think of targeting its systems.