Teenage hacker who made $738,000 from virus jailed for two years

A teenage computer hacker who made nearly £400,000 ($738,840) by creating a programme which was used in 1.7 million attacks from Greenland to New Zealand was jailed for two years today.

Adam Mudd, now 20, sold access to the Titanium Stresser tool which let users crash websites and computers by flooding them with data.

He developed the distributed denial of service, or DDoS, software from his bedroom, and started selling it to criminals when he was at school aged 16, the Daily Mail reported.

The 1.7m attacks were carried out against more than 650,000 victims, of which more than 52,000 were in the UK.

Victims included Xbox Live users, and players of the computer games Runescape and Minecraft.

Runescape was targeted 25,000 times, 1.4 per cent of the total attacks, and in the past four years the company spent nearly £6m attempting to protect themselves from hackers.

Mudd raked in a total of $307,298.35 and 259.81 bitcoins, worth £386,079, by the time he was 18.

Using the user name ''themuddfamily'', he also carried out nearly 600 attacks himself against 181 victims from his bedroom in Kings Langley, Hertfordshire.

One 2014 attack on West Hertfordshire College, where he studied, was so large it may have hit 70 nearby schools and universities, including the University of Cambridge.

He attacked his college four times that year, later claiming it was because he had been mugged but no action was taken, the Old Bailey heard.

Mudd admitted computer hacking and money laundering last October.

Today he was sentenced to two years in a young offenders' institution.

The defendant showed no emotion as his sentence was passed, while his parents sat in the well of the court.

The judge rejected a plea to suspend sentence by the defence, who said Mudd had been offered two weeks of paid work in cyber security.

Sentencing him, Judge Michael Topolski QC said: "The map of the world showing the geographical spread of these attacks which went on for 18 months is revealing, showing the truly worldwide nature.

"IP addresses from Greenland to New Zealand, from Russia to Chile, were attacked.

"The capacity for harm in this case was, in my judgment, very great.

"There is clear evidence before me not only of actual damage, but also of significant financial benefit to the defendant.

"It is now impossible to imagine a world without the internet. There is no part of life that is not touched by it.

"In some way, these offences may be relatively easy to commit. But they are increasingly prevalent, and the public is entitled to be protected from them.

"I am satisfied that financial gain was not the main motivating factor."

He added: "I am satisfied that notwithstanding the defendant's condition, he knew full well he was committing serious crime and, in doing so, was taking a risk with his liberty. Yet he continued with his illegal activities for some time.

"I am entirely satisfied that you knew full well and understood completely this was not just a game, a game for fun.

"It was a serious money-making business, and that your programme software was doing exactly what you had created it to do.

"I am unable to suspend this sentence in the light of the time span of your offending, the high level of your culpability, and the harm caused."

Referring to the job offer he added: "I have little doubt that similar opportunities will present themselves in the future."

Mudd did not have a lavish lifestyle, and carried out his crimes to achieve "status", prosecutor Jonathan Polnay said.

But $18,770 came out of PayPal accounts into Mudd's father's bank account.

Ben Cooper, defending, said this was to pay tax and National Insurance contributions on initial legitimate earnings from the programme.

But the judge said: "The use of some of the funds to pay tax and insurance is concerning to say the very least of it."

The defence also passed Judge Topolski letters from the Howard League for Penal Reform, Mudd and his parents.

Describing the job offer, Mr Cooper said: "Working with cyber security. That is, helping companies avoid attacks and potential losses, and putting all of his skills to use to really reverse the wrong he acknowledges having done in the past."

Mudd received 24 months for doing unauthorised acts with intent to impair the operation of a computer, nine months to run concurrent for making, supplying or offering to supply the programme, and 24 months concurrent for concealing criminal property.

Outside court, Mudd's parents said they were "devastated" at the judge's decision not to suspend his sentence.

They said their son had been "let down by the health services' failure to diagnose his condition earlier".