Yes—unauthorized access to Disney data occurred, but the original “NullBulge hacked Disney” story was incomplete. In July 2024, the online persona NullBulge claimed to have taken about 1.1 TB (reportedly 1.1 TiB in the leak post) from Disney’s internal Slack environment. On May 1, 2025, the U.S. Department of Justice said California resident Ryan Mitchell Kramer had agreed to plead guilty after using malware disguised as an AI-art program to compromise a Disney employee’s computer, obtain stored credentials, access the employee’s Disney Slack account, and download approximately 1.1 terabytes of confidential data from thousands of non-public channels. The DOJ described NullBulge as a fictitious Russia-based hacktivist group, not a confirmed independent Russian organization.
What NullBulge claimed in July 2024
The July 2024 disclosure began with claims from an actor using the name NullBulge. The actor said it had obtained roughly 1.1 TB of material—described as 1.1 TiB in its leak post—from nearly 10,000 Disney Slack channels. The advertised collection allegedly included internal messages, files and attachments, unreleased project information, concept art and other images, source code, links to internal systems, and login information.
At that point, Disney had not publicly verified the claim. The original reports therefore correctly treated the story as an allegation, although the scale and apparent variety of the material attracted substantial attention. BleepingComputer documented the original leak claims and subsequent criminal case in its coverage of the incident: its report on the Disney Slack theft.
A terabyte figure does not, by itself, show how much unique or highly sensitive information was involved. Slack exports can contain duplicate files, attachments, message history, logs, cached data, and other repeated material. The number also uses two storage conventions: decimal terabytes and tebibytes are different units, but the distinction does not materially change the account of what happened.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhat was later established
The evidentiary picture changed with the DOJ’s May 1, 2025 announcement. According to the U.S. Attorney’s Office for the Central District of California, Kramer agreed to plead guilty to accessing a computer and obtaining information, and to threatening to damage a protected computer.
| Point | What the DOJ said |
|---|---|
| Person identified | Ryan Mitchell Kramer, 25, of Santa Clarita, California |
| Data acquired | Approximately 1.1 terabytes of confidential data |
| Source | Thousands of non-public Disney Slack channels |
| Public release | Stolen files were released on or around July 12, 2024 |
| Online identity | Kramer allegedly posed as a member of a fictitious Russia-based group called NullBulge |
| Charges | Obtaining information from a computer and threatening to damage a protected computer |
| Maximum statutory penalty cited | Five years in federal prison for each count |
The announcement concerns a plea agreement, not a sentencing decision. It also does not provide a complete, independently verified inventory of every item in the released archive.
How the access reportedly happened
The DOJ’s account describes a malware-and-credential compromise rather than a demonstrated vulnerability in Slack itself.
- Kramer uploaded a program presented as an AI-generated-art tool.
- The program contained a malicious file.
- A Disney employee downloaded and ran it on a personal computer.
- Kramer gained access to that computer and obtained login information and passwords stored there.
- He used the credentials to enter the employee’s Disney Slack account.
- From that account, he downloaded confidential material from thousands of internal channels.
BleepingComputer separately reported that credentials connected with a password manager were among the information taken from the employee’s computer. That detail is secondary reporting, not a complete finding in the DOJ announcement, and it does not establish which credentials remained valid after the incident.
What information was exposed?
Categories described in the leak claims
- Internal Disney Slack messages
- Files and attachments
- Unreleased project material
- Concept art and raw images
- Source code
- Links to internal APIs or webpages
- Possible login information
- Employee personal information
These categories were drawn partly from the attacker’s own description and from secondary reporting. They should not be read as a government-certified list of every file.
Information specifically identified by the DOJ
The DOJ confirmed that approximately 1.1 TB of confidential data was downloaded from thousands of Disney Slack channels. It also said that the public release included the affected employee’s bank, medical, and personal information, and that Disney Slack files appeared on multiple online platforms.
The cited announcement does not establish that Disney customer databases, Disney+ subscriber records, payment-card systems, or complete unreleased films were compromised. It likewise does not verify that every advertised project, credential, or file was authentic, complete, or uniquely obtained from Disney.
Was customer data stolen?
Public government records confirm confidential corporate data and personal information belonging to at least the affected employee. They do not establish a broad theft of Disney customers’ or subscribers’ records. Employee information exposed in the release should not be described as proof that Disney’s consumer database or payment systems were breached.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWho was NullBulge?
Early coverage often treated NullBulge as a hacking or hacktivist group. The later DOJ account is more specific: Kramer allegedly pretended to be part of a fictitious Russia-based hacktivist group called NullBulge. On the evidence described in that announcement, “NullBulge” is best treated as an online identity used by Kramer, not as a confirmed organized Russian collective.
The persona’s stated opposition to AI-generated art and complaints involving Disney may help explain the public messaging, but those motives were claims or reported positions rather than independently established facts about the operation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.From theft to public leak
The incident had distinct stages. The alleged compromise and download occurred before the public disclosure. In July 2024, Kramer reportedly contacted the Disney employee by email and Discord, threatened to release the employee’s personal information and Disney’s Slack data, and then published the files after the employee did not cooperate. The DOJ identified July 12, 2024, as the date of the public release.
That distinction matters: data exfiltration, an extortion-style threat, and public release were separate events, not one instantaneous “hack.”
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What this incident does—and does not—prove
- It supports the conclusion that an attacker compromised a Disney employee’s computer and credentials, accessed a Disney Slack account, and downloaded a large volume of internal data.
- It does not show that attackers penetrated every Disney system or Slack’s underlying infrastructure.
- It does not confirm a mass theft of Disney+ or other consumer subscriber records.
- It does not establish that a known Russian hacking group carried out the operation.
- It does not provide a complete public inventory proving the authenticity or current validity of every leaked credential and file.
Legal aftermath
On May 1, 2025, the DOJ announced Kramer’s agreement to plead guilty to one count of accessing a computer and obtaining information and one count of threatening to damage a protected computer. Each count carried a statutory maximum of five years, according to the announcement. The FBI was investigating. A plea announcement should not be confused with a final sentence.
Security lessons for companies using collaboration platforms
The most important lesson is the access path, not simply the 1.1-terabyte headline. A convincing-looking unofficial tool can deliver malware; a compromised workstation can expose saved passwords and sessions; and one employee’s Slack access can reveal sensitive information spread across many channels.
- Block or closely control unofficial software downloads, including purported AI utilities.
- Use endpoint detection to identify credential-stealing malware and unusual archive or bulk-download activity.
- Protect password-manager vaults, browser sessions, and stored tokens with strong device controls and multifactor authentication.
- Apply least privilege to collaboration accounts and review who can access sensitive channels.
- Keep secrets, API keys, medical information, and personal records out of general-purpose chat where possible.
- When compromise is suspected, revoke sessions, rotate credentials, investigate the endpoint, and monitor for data exfiltration and reposting.
Those are general defensive practices; the cited government announcement does not document Disney’s specific remediation steps.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
