St. Louis Cardinals Hacker Sentenced To 46 Months In Prison

Former Cardinals scouting director Christopher Correa won't be doing any hacking any time soon

Getty Images
Jul 18, 2016 at 3:47 PM ET

Former St. Louis Cardinals scouting director Christopher Correa was sentenced on Monday to serve a grand total of 46 months in a federal prison after pleading guilty in January to hacking the Houston Astros’ proprietary database, Ground Control. Correa could have been sent away for five years and paid out a $250,000 for each of his five felony counts, all of which would have been served concurrently. He also has to fork over an additional $279,000 in restitution fees, according to the Houston Chronicle.

“I violated my values and it was wrong … I behaved shamefully,” Correa said in a letter he read prior to sentencing. “The whole episode represents the worst thing I’ve done in my life by far.”

Though not explicitly named in the federal indictment, the “Victim A” that Correa hacked is presumed to be Jeffrey Luhnow. In December of 2011, Luhnow, then Cardinals’ vice president for scouting and player development, scored a job revitalizing the then-moribund Astros, taking over as general manager. According to the indictment, prior to leaving his post, “He was directed to turn over his Cardinals-owned laptop to to Correa—along with the laptop’s password.”

Foolishly enough, he used the same danged password for both his work email and to access the entirety of the team’s database.

And so, in March 2013, Correa was able to “hack” the Astros by simply plugging in Luhnow’s old password. He continued to snoop around the team’s inner workings, getting a look at trade proposals, conversations with other MLB teams, and internal scouting reports, on multiple occasions, including during the MLB draft and on July 31, the day of the the trade deadline. The Cardinals finally got around to resetting their passwords and site URL after the Houston Chronicle ran an article highlighting the database, but that didn’t prevent Correa from logging into Luhnow’s email again—which, yes, he still hadn’t updated—and digging around until he found a communiqué with the brand new passwords and URL that let him walk right back in through the front door.

He might have gotten away with it too, had Deadspin not discovered that 10 months’ worth of the Astros’ internal workings had been dumped at the now-shuttered anonymous online data sharing site, Anonbin. According to Yahoo Sports’ Jeff Passan, the information published by Deadspin in June 2014 doesn’t represent the entirety of the hacked data.“There was more out there,” an anonymous source told Passan. MLB sprang into action, launching an investigation, followed hard upon a year later by the FBI and the Justice Department.

The question now is, what penalties might MLB levy? Commissioner Rob Manfred has said that his office would refrain from taking action until after Correa’s case made its way through the legal system.

“We anticipate that the authorities will share with us the results of their investigation at the appropriate time,” the league said a statement after Correa pled guilty. “And we will determine what further actions to take after receiving all of the relevant information.”

But it’s likely that the Cardinals will be docked some combination of draft picks and/or suffer a substantial fine, regardless of whether or not they were aware of Correa’s actions.