Kentucky inmates hack prison-issued devices in $1M digital heist

Hundreds of Kentucky inmates figured out a way to hack into their state-issued computer tablets – making off with more than $1 million worth of digital credits – all so the prisoners could buy online privileges while behind bars.

It’s a story of greed, stupidity (on the part of the Kentucky Corrections Department in charge of the devices), and the desire to connect with family, according to prison advocates and a local Kentucky news outlet just uncovering the massive scam.

Apparently, the digital assets were used by the inmates to purchase creature comforts such as video games, music, movies, and more notably, email and video chat credits prisoners use to communicate with family members and loved ones.

The McClatchy-owned Lexington Herald-Leader stated in an investigative piece published last week that it all began sometime in December 2022 and continued even after prison officials were anonymously tipped off to the scam just days into the New Year.

According to 1,700 pages of internal investigative records examined by the newspaper, the endless supply of ‘digital dollars’ was created and deposited into inmates’ online accounts using an in-house prison app only accessible on state-issued tablets.

Texas-based Securus Technologies, the company responsible for creating the prison technology and providing the tablets, has had a contract with Kentucky’s Department of Corrections since 2006 and sells digital devices and products in multiple correction facilities.

The state gets a cut of whatever Securus makes off the inmates – which can add up, as canteen purchases in Kentucky prisons total about $4 million a year, the report stated.

Inmates: funds “just appeared” in our accounts

The report states that within 24 hours of the prison introducing a new commissary app onto the tablets in December 2022, one of the Kentucky prisoners – a 30-year-old man serving a 30-year sentence for child sexual abuse – had already figured out how to hack it.

Word spread quickly throughout the prison, and soon inmates were depositing hundreds of digital dollars and credits at a time into their online accounts.

“Over the next few weeks, according to one estimate prepared by internal investigators, 366 inmates collectively added $529,000 both to their commissary accounts and their Securus accounts, for a total of more than $1 million,” the Herald-Leader revealed.

Due to the hundreds of inmates involved in the hustle, it took Securus more than six months after the January 3rd tipoff to “figure out who bought what with stolen money and how it might be recovered,” the Herald-Leader reported.

Once the inmate scam came to light, prison officials quickly took steps to confiscate the tablets and freeze accounts. Some inmates were punished with a few weeks of solitary confinement, but as of today, no one has officially been charged with a crime.

Not surprisingly, almost all of the inmates involved had “refused to answer questions,” while other inmates claimed the money had “just appeared” in their accounts, investigators said at the time.

The paper said that even though some of the guilty were forced to pay back what they had taken, the prison eventually suggested to Securus that the two just split the losses 50/50.

Not the first digital prison heist

Unbelievably, the Kentucky hack is not the first time a digital swindle of the same sort has taken place within the US prison system.

The Herald-Leader found that in 2018, hundreds of Idaho inmates also distributed roughly $225,000 worth of digital assets among the prison population after hacking state-issued tablets provided by a company related to Securus.

For reference, there are five federal prisons, twelve state prisons, and 20 county jails in the state of Kentucky, the Corrections Department website states.

Furthermore, it’s not clear which of those facilities fell victim to the hacks, although most thefts were reported to have occurred inside Kentucky's Luther Luckett Correctional Complex, a 1200-bed medium/maximum security state prison.

Kentucky justice department officials told the Herald-Leader that no taxpayer money was lost during what the officials referred to as a "software glitch."