Idaho prison inmates hacked tablets to steal more than $200,000

A group of 364 prison inmates in Idaho correctional
facilities hacked JPay tablets to steal nearly
$225,000.
Ariel
Schwartz

• A group of 364 inmates across Idaho correctional
  facilities hacked hand-held tablets in a mass scheme to steal
  nearly $225,000. 
• The inmates used the popular JPay tablets to transfer
  the funds into their own accounts. 
• JPay is a private company that provides digital
  services allowing inmates across the country to use email and
  play online games. 

A group of 364 prison inmates in Idaho correctional facilities
hacked hand-held tablets to collectively steal nearly $225,000,
officials say. 

The inmates used the popular JPay tablets to transfer the funds
into their own accounts by exploiting a “vulnerability” within
the device, Idaho Department of Correction Spokesman
Jeff Ray said in a statement to the
Associated Press. 

JPay is a private company that provides digital services allowing
inmates across the country to email family and friends, play
electronic games, or purchase and listen to music.

Ray said that 50 inmates credited more than $1,000 to their
accounts, and the largest sum transferred by a single inmate was
just under $10,000. 

“This conduct was intentional, not accidental. It required a
knowledge of the JPay system and multiple actions by every inmate
who exploited the system’s vulnerability to improperly credit
their account,” Ray said.

It remains unclear what the vulnerability was within JPay’s
system that allowed inmates to transfer the money, or how so many
inmates became aware of it, according to
The Verge. 

JPay has recovered about $65,000 of the $225,000 from
inmates. The company also suspended the ability to use credits on
the system until it recovers the rest of the funds. 

The Idaho Department of Corrections has issued disciplinary
offense records to inmates who were allegedly involved in the
hack. 

In Idaho, the tablets, which are unable to access the
internet, are made available to inmates through a contract with
CentryLink and JPay. 

Idaho Department of Corrections has approximately 8,000
inmates across 10 prisons and four community re-entry centers. If
364 inmates were involved in the hack, that’s 4.5% of the state’s
adult inmates. 

JayPay spokesperson Jade Trombetta said in a
statement: “JPay is proud to provide services that allow
incarcerated individuals to communicate with friends and family,
access educational programming and enjoy positive entertainment
options that help prevent behavioral issues. 

“While the vast majority of individuals use our secure
technology appropriately, we are continually working to improve
our products to prevent any attempts at misuse.”