On Monday, July 18, 2016, the U.S. District Court for the Southern District of Texas sentenced former St. Louis Cardinals scouting director Chris Correa to nearly four years in prison for the hacking of the Houston Astros’ emails and player information database. The following day, Major League Baseball announced it will launch its own investigation into the hacking scandal now that the criminal case has concluded. The case marks the first known instance of criminal corporate espionage in U.S. professional sports.
Correa’s unauthorized access to the Astros’ data did not involve sophisticated hacking – rather, he gained access to the confidential data when a Cardinals’ employee resigned to take a job with the Astros. Correa received the departing employee’s Cardinals-issued computer, along with that device’s password, and used variations of the password to figure out the employee’s new password with the Astros. Those credentials gave Correa unauthorized access to the now-Astros’ employee’s email account and the “Ground Control” player information database maintained by the Astros organization.
Over the course of a year and at least 5 log-in attempts, Correa viewed, among other protected data, an Astros report that discussed team prospects, certain player contracts and related bonus offers, and information on the Astros’ potential trades with other MLB teams. The intended loss to the Astros for all of Correa’s privacy breaches totaled $1.7 million. Correa pled guilty earlier this year to five counts of unauthorized access of a protected computer and was sentenced last week to 46 months in prison.
Following Correa’s sentencing, MLB Commissioner Rob Manfred asked the League’s Department of Investigations to conduct a complete investigation of the facts in this matter. The MLB investigation could potentially lead to penalties for the Cardinals organization, which fired Correa in July 2015. According to the Major League Baseball Constitution, the commissioner has broad power to “investigate . . . any act, transaction or practice charged, alleged or suspected to be not in the best interest of the national game of baseball,” and can take punitive action against MLB clubs, owners, employees or players involved.
