Overview
- A federal judge on June 24, 2026 ordered 21-year-old Nathan Austad to serve 18 months in prison, to serve three years of supervised release, and to pay about $1.8 million in restitution and forfeiture.
- Austad pleaded guilty in December 2025 to conspiracy to commit computer intrusion and admitted that he and co-conspirators compromised about 60,000 user accounts in the November 2022 credential-stuffing attack.
- Prosecutors say the group added payment methods to roughly 1,600 accounts and stole about $600,000, and investigators linked approximately $465,000 in cryptocurrency to Austad’s activity.
- Austad ran an online shop to sell access to hacked accounts and exchanged messages showing he knew the activity was illegal; two other defendants have already been sentenced, with Kamerin Stokes receiving 30 months and Joseph Garrison receiving 18 months.
- Credential stuffing uses reused credentials from prior breaches to take over accounts, and this case shows law enforcement can follow sales on criminal marketplaces and crypto flows to secure prison terms and financial recovery for victims.