Do Hackers Go to Jail? Federal Sentences, CFAA, and State Charges

Yes, hackers do go to jail. Under the federal Computer Fraud and Abuse Act, sentences range from up to one year for basic unauthorized access to life in prison when a hacking offense causes someone’s death, and prosecutors almost always add related charges like wire fraud and aggravated identity theft that make real sentences longer than the CFAA maximums alone would suggest.¹ State laws add another layer, and a defendant can be prosecuted by both a state and the federal government for the same conduct.

How Long a Hacker Goes to Prison Under Federal Law

The CFAA, at 18 U.S.C. § 1030, sets prison time according to what the hacker did and whether they have prior convictions. The tiers stack roughly like this:¹

Basic unauthorized access, first offense: up to one year.
Unauthorized access for commercial gain, to further another crime, or to obtain information worth more than $5,000: up to five years.
Accessing national security information: up to 10 years first offense, 20 years for a repeat.
Computer fraud and extortion, which covers most ransomware conduct: up to five years first offense, 10 for a repeat.
Intentionally damaging a protected computer through malware, data destruction, or attacks that take systems offline: up to 10 years first offense, 20 for a repeat.
An offense causing serious bodily injury: up to 20 years.
An offense resulting in death: any term of years up to life imprisonment.

The term “protected computer” reads narrow but isn’t. It covers any computer used in or affecting interstate or foreign commerce, which in practice means anything with an internet connection. A small business server, a home router, a hospital workstation: all protected computers under the statute.¹

The Charges That Get Stacked On

Prosecutors rarely charge a hacker under the CFAA alone. Most hacking conduct violates several federal statutes at once, and stacking is standard.

Wire Fraud

Any scheme to defraud using electronic communications falls under 18 U.S.C. § 1343, with a baseline of up to 20 years in prison. If the scheme targets a financial institution, the ceiling rises to 30 years and a fine of up to $1,000,000.² Phishing, business email compromise, and data theft for financial gain almost always draw wire fraud counts alongside the CFAA charges.

Aggravated Identity Theft

This is the charge that turns a moderate sentence into a long one. Under 18 U.S.C. § 1028A, using stolen credentials or personal information during a felony adds a mandatory two-year prison term. A judge cannot order probation instead, cannot reduce the sentence for the underlying crime to compensate, and cannot let the two years run concurrently with the other sentence.³ It’s a common addition in data breach prosecutions.

Identity Fraud

A broader identity fraud statute, 18 U.S.C. § 1028, covers possessing or using another person’s identification to commit any federal felony or a state-level felony. Hackers who steal personal data often face charges under both § 1028 and § 1028A.⁴

The Money Consequences Beyond Prison

A hacking conviction reaches well past the sentence itself.

Criminal forfeiture. A court must order anyone convicted under the CFAA to forfeit any personal property used to commit the offense and any proceeds derived from it. That includes computers, servers, and cryptocurrency wallets.¹

Mandatory restitution. Federal law requires restitution when an identifiable victim suffered a financial loss from an offense against property committed by fraud or deceit. Most CFAA convictions fall into that category, and in major data breach cases restitution orders can reach millions of dollars.⁵

Civil lawsuits. The CFAA also gives victims a private right of action. Anyone who suffers damage or loss from a CFAA violation can sue for compensatory damages and injunctive relief, and the suit must be filed within two years of the violation or the discovery of the damage, whichever is later.¹ These lawsuits proceed regardless of whether criminal charges are filed.

What Doesn’t Count as Hacking Under the CFAA

Not every misuse of a computer at work is federal hacking. In Van Buren v. United States (2021), the Supreme Court held that someone “exceeds authorized access” only when they enter areas of a system entirely off-limits to them, not when they access information they’re permitted to see but for an improper purpose. The Court called this a “gates-up-or-down” test: either your credentials extend to that part of the system or they don’t.⁶

So an employee who legitimately has access to a database but looks up records for personal reasons or sells the data hasn’t violated the CFAA by that access alone. Prosecutors would need a different statute. But anyone who breaks into a system they were never authorized to use, or accesses files their credentials don’t permit, is squarely within the CFAA.

State Charges Add Another Layer

All 50 states have their own computer crime statutes, and many mirror the CFAA. Basic unauthorized access is often a misdemeanor carrying under a year in jail; hacking that causes significant financial damage or targets critical infrastructure is generally a felony with multi-year prison terms.

Because the internet crosses state lines by default, state prosecutors often defer to federal authorities on large cases. State charges are still common for localized offenses. And a defendant can face state and federal charges for the same conduct without triggering double jeopardy, because state and federal governments are separate sovereigns.

As a practical matter, federal jurisdiction reaches almost any hacking case the Department of Justice wants to bring, since almost any internet-connected computer is a “protected computer.” The FBI and DOJ concentrate resources on large-scale breaches, attacks on critical infrastructure, and cases with national security implications. Federal cases tend to carry heavier sentences and involve longer investigations with more sophisticated forensics.

What Judges Weigh at Sentencing

Statutory maximums are ceilings. The actual sentence turns on factors a judge weighs under 18 U.S.C. § 3553: the nature of the offense, the defendant’s history and criminal record, the need to deter similar conduct, and the need to provide restitution.⁷

In cybercrime cases specifically, courts look closely at how much financial damage was caused, how many people were affected, how sensitive the compromised data was, and how sophisticated the methods were. Someone who exploited a simple misconfiguration out of curiosity and caused no lasting damage draws a very different sentence than someone who deployed custom malware to steal millions of financial records.

Cooperation is the single most effective way to reduce a sentence. Defendants who help investigators identify co-conspirators, explain their technical methods, or assist in recovering stolen data frequently receive substantial reductions. Federal sentencing guidelines formally account for this, and prosecutors can file motions asking the court to depart below the normal guideline range for cooperating defendants.

Hacking From Outside the United States

Being abroad doesn’t put a hacker out of reach. Federal law defines an “international cyber criminal” as anyone believed to have committed a cybercrime against U.S. interests for whom a U.S. arrest warrant has been issued or an Interpol Red Notice has been circulated.⁸

When the suspect is in a country with a U.S. extradition treaty, prosecutors can ask that country to arrest and transfer the individual for prosecution in a U.S. court. When extradition isn’t feasible, the Secretary of State must consult with officials in the country where the individual is located about what steps that government is taking.⁸ Some foreign hackers have been arrested while traveling through countries that do have extradition agreements with the United States, even when their home country would not have cooperated.

1
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection With Computers
2
Office of the Law Revision Counsel. 18 USC 1343 – Fraud by Wire, Radio, or Television
3
Office of the Law Revision Counsel. 18 USC 1028A – Aggravated Identity Theft
4
Office of the Law Revision Counsel. 18 USC 1028 – Fraud and Related Activity in Connection With Identification Documents, Authentication Features, and Information
5
GovInfo. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes
6
Supreme Court of the United States. Van Buren v. United States, 593 U.S. 374 (2021)
7
Office of the Law Revision Counsel. 18 USC 3553 – Imposition of a Sentence
8
Office of the Law Revision Counsel. 6 USC 1531 – Apprehension and Prosecution of International Cyber Criminals