California man admits to hacking Disney employee, leaking company data

A 25-year-old California man has agreed to plead guilty to hacking the personal computer of a Walt Disney Company employee, stealing internal data, and later releasing sensitive files online after issuing threats, according to federal prosecutors.

According to the U.S. Attorney’s Office for the Central District of California, Ryan Mitchell Kramer, a Santa Clarita resident, will plead guilty to one count of accessing a computer and obtaining information and one count of threatening to damage a protected computer. Each felony charge carries a maximum sentence of five years in federal prison.

According to the plea agreement, the case began in early 2024 when Kramer posted a computer program on sites including GitHub, advertising it as a tool for creating AI-generated art, tut the program contained a malicious file that gave Kramer unauthorized access to computers of those who downloaded it.

Between April and May 2024, one victim—a Disney employee—downloaded the program, inadvertently granting Kramer access to the victim’s personal computer and stored login credentials. Using that information, Kramer accessed the employee’s Slack account, which was used for internal Disney communications. He then downloaded approximately 1.1 terabytes of confidential data from thousands of Disney Slack channels.

In July 2024, Kramer posed as a member of a fictitious Russia-based hacktivist group called “NullBulge” and contacted the victim via email and Discord. Prosecutors say he threatened to leak the victim’s personal and financial information, along with the stolen Disney data, unless the victim responded.

When the victim did not comply, Kramer followed through on his threat, publishing the internal Disney files and the victim’s private information on multiple online platforms.

Kramer also admitted that at least two other individuals downloaded the malicious program, allowing him to access their computers and accounts as well.

Prosecutors say Kramer is expected to make his initial court appearance in downtown Los Angeles in the coming weeks. The case is additionally being investigated by the FBI.