October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PCOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
DocumentaryTube
Admit one · Blog

Phony Hacktivist Agreed to Plead Guilty in Disney Data Leak

A California man agreed to plead guilty after prosecutors said he used malware disguised as an AI-art tool to access a Disney employee’s Slack account and steal about 1.1 TB of data.
Opened Runtime5 min Written byDocumentaryTube Team
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Ryan Mitchell Kramer, a 25-year-old from Santa Clarita, California, agreed on May 1, 2025, to plead guilty to two federal felonies after prosecutors said he used a malicious AI-art program to compromise a Disney employee’s personal computer, access the employee’s work Slack account and download about 1.1 terabytes of data from thousands of Disney Slack channels. The Justice Department described the supposed “NullBulge” hacktivist identity as fake. Its announcement documented a plea agreement, not a court’s acceptance of a guilty plea or a sentence.

How the attack reached Disney Slack

The Justice Department’s account describes a route through an employee’s personal computer and credentials—not an identified exploit of Disney’s core infrastructure or Slack itself. Prosecutors said Kramer posted a program on online platforms, including GitHub, in early 2024, presenting it as software for generating AI art. The program contained a malicious file that could give him access to computers where it was installed.

  1. Malicious software was presented as an AI-art tool. Prosecutors said a victim downloaded the file in April or May 2024.

  2. The victim’s computer and accounts were accessed. According to the Justice Department, Kramer obtained stored credentials and passwords from the personal computer.

    Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
    #1 Best Overall
    Sale
    Elebase USB to USB C Adapter for iPhone 18 Pro Max,USBC Car Charger Adapter
    • Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
    • Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
    • Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
    • Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
    • 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
  3. Credentials opened a work-related Slack account. Prosecutors said the victim used that account in their work for Disney, and Kramer used it to enter non-public Disney Slack channels.

  4. Data was downloaded and threats followed. In May 2024, prosecutors said, Kramer downloaded about 1.1 terabytes from thousands of channels. In July, he contacted the victim by email and Discord while claiming to represent NullBulge, threatening to release personal information and Disney data.

  5. The files were published after no response. The Justice Department said Kramer released Disney files and the victim’s bank, medical and personal information on July 12, 2024.

The government’s description centers on malware, stolen credentials and access through an employee account. It does not establish that Disney’s network was entered by exploiting a Slack vulnerability.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Sale
Anker USB-C Hub, 5-in-1 USB Hub for Laptops, 4K HDMI Multiport Adapter
  • 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
  • 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
  • Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
  • 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
  • What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.

What data was taken and reported exposed

The Justice Department put the amount downloaded at approximately 1.1 terabytes from thousands of Disney Slack channels. SentinelLabs described the publicly released material as roughly 1.2 TB and said it purported to contain multiple years of internal Slack data. Those are different source descriptions of volume, not a verified count of records or proof that every item in the archive was authentic or complete.

The government specifically identified Disney Slack files and the victim’s bank, medical and personal information. SecurityWeek and Dark Reading additionally reported that the Disney material included messages, information about unreleased projects, login credentials and source code. Those additional categories are media reporting, not a complete official inventory of the exposed files.

Neither the terabyte figure nor the reference to thousands of channels establishes that every Disney channel, employee or system was affected. The full inventory and the completeness and authenticity of the publicly released archive have not been established in the cited accounts.

What “NullBulge” was—and what the identity concealed

NullBulge presented itself as a Russia-based hacktivist group concerned with artists’ rights, AI-generated content and compensation. Prosecutors said Kramer pretended to represent the group when he threatened the employee. The Justice Department called it a fake Russia-based hacktivist group.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #3
Sale
Anker USB C Hub, 7in1 Multi-Port USB Adapter, 4K@60Hz USBC to HDMI Splitter
  • Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
  • Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
  • Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
  • Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
  • What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.

SentinelLabs’ analysis provides a different picture of the wider operation: it described activity involving malware distribution, infostealers and ransomware-related operations, including commodity malware, Async RAT, Xworm and LockBit-derived tooling. It also reported the sale of stolen information, including infostealer logs and OpenAI API keys. That context supports describing NullBulge’s public activism as a persona associated with criminal activity, but it does not make every reported operation part of the Disney incident or establish a judicial finding about the group’s identity or motives.

The distinction matters: this was not simply a case of an established political movement claiming a data leak. Prosecutors say one person adopted a hacktivist identity while threatening an individual and publishing stolen data. SentinelLabs’ broader findings concern other activity attributed to NullBulge.

The plea agreement and possible penalties

On May 1, 2025, the U.S. Attorney’s Office for the Central District of California announced that Kramer had agreed to plead guilty to two counts: accessing a computer and obtaining information, and threatening to damage a protected computer. Each count carries a statutory maximum of five years in federal prison, making the combined maximum ten years.

A statutory maximum is not a prediction of the sentence. The eventual outcome depends on the court and applicable sentencing factors. The Justice Department announcement said Kramer was expected to make an initial federal court appearance in the following weeks; the cited materials do not establish a later accepted plea, final judgment or sentence. The matter was investigated by the FBI, and Assistant U.S. Attorneys Lauren Restrepo and Maxwell Coll of the Cyber and Intellectual Property Crimes Section were handling the prosecution.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
Sale
UGREEN USB to USB C Adapter Combo 4-Pack, 10Gbps USB C Converter Space Gray
  • Dual Converters, Infinite Potential:Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
  • Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
  • Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
  • Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
  • Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft

Other victims and Disney’s reported response

Kramer admitted that at least two additional victims downloaded his malicious file and that he gained unauthorized access to their computers and accounts. The Justice Department said the victims had not been publicly identified and the FBI investigation was continuing.

Separately, Dark Reading and SecurityWeek reported that Disney stopped using Slack for internal communications after the breach and that the employee who downloaded the tool was terminated. Dark Reading also reported that the former employee filed a wrongful-termination complaint. Those reports concern Disney’s response and a separate employment dispute; they are not terms or findings of Kramer’s federal case.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Security lessons from the attack chain

The incident illustrates how an apparently personal-device compromise can become an organizational data breach when work credentials are available from that device. The Justice Department’s account does not specify Disney’s authentication, endpoint or access-control settings, so the controls below are general lessons rather than claims about what Disney did or did not deploy.

  • Separate personal and work access. Organizations can reduce exposure by limiting access from unmanaged devices and applying endpoint protections to devices that reach corporate services.

    Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
    Best Value
    Sale
    Anker USB C Hub, 5-in-1 USBC to HDMI Splitter with 4K Display
    • 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
    • Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
    • Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
    • HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
    • What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
  • Protect credentials and make stolen passwords less useful. Avoid storing work secrets in unprotected files or browser stores; use unique credentials and phishing-resistant multifactor authentication where supported.

  • Limit the reach of each account. Least-privilege access, regular permission reviews and controls on historical or sensitive channels can reduce how much one compromised account exposes.

  • Look for secrets in collaboration systems. Messages, attachments and repositories can accumulate credentials and other sensitive data. Secret scanning, secure handling and prompt revocation can reduce the impact of accidental exposure.

  • Evaluate software provenance, not the promise on its label. An AI-art tool was the reported lure; the case does not show that an AI model or AI service was hacked. Untrusted downloads should not be run on devices holding work credentials.

    Free tools Windows power users keep installed

    One-click scans. No signup required.

    Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A collaboration-platform migration alone would not address the underlying risks of malware on an endpoint, exposed credentials or overly broad access. Effective defenses span device security, identity, permissions and data handling.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Screening Room

  1. OTT review: ‘Do You Wanna Partner’ serves up more froth than flavourAdmit one · BlogOTT review: 'Do You Wanna Partner' serves up more froth than flavourOpened08 OCT 2026Runtime6 min
  2. Anitta no Latin AMAs: veja onde assistir à performance de 2024Admit one · BlogAnitta no Latin AMAs: veja onde assistir à performance de 2024Opened08 OCT 2026Runtime2 min
  3. Why Grimes Called Kito’s AI-Voice Track “Cold Touch” a “Masterpiece”Admit one · BlogWhy Grimes Called Kito's AI-Voice Track “Cold Touch” a “Masterpiece”Opened08 OCT 2026Runtime4 min
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.