LulzSec

LulzSec (short for “Lulz Security”) was a hacking collective that operated publicly for roughly 50 days, from May 2011 to late June 2011. It grew out of a smaller precursor group sometimes called Internet Feds, whose members had already participated in the February 2011 breach of the security firm HBGary Federal — an incident closely tied to Anonymous but distinct from LulzSec itself, which formed afterward. LulzSec is best understood as an offshoot or splinter of the broader, leaderless Anonymous movement: several individuals moved between the two, and Anonymous is covered separately elsewhere in this encyclopedia.

Formation and Identity

LulzSec announced itself in May 2011 with a Twitter account and website, framing its attacks as done partly for entertainment (“for the lulz”) and partly to expose weak security at major organizations. Unlike Anonymous’s diffuse structure, LulzSec operated as a small, tight-knit crew, widely reported as roughly six core participants.

Breach Campaign

Over its active period LulzSec claimed responsibility for a rapid sequence of intrusions and denial-of-service attacks: theft of contestant data from Fox’s X Factor and internal Fox employee data; a fabricated news story and leaked user data at PBS (in apparent retaliation for a Frontline documentary on WikiLeaks); a large SQL-injection breach of Sony Pictures in early June 2011 exposing personal data on tens of thousands of users; leaks tied to the FBI-affiliated InfraGard organization; a DDoS attack against CIA.gov on June 15, 2011; disruption of online games including Minecraft, League of Legends, and EVE Online during what it called “Titanic Takedown Tuesday”; release of data from Arizona Department of Public Safety (“Chinga la Migra”) targeting officers over immigration enforcement; and, after its formal dissolution, defacement of The Sun/News International websites in July 2011 with a fake story about Rupert Murdoch. The group's final release, dubbed “50 Days of Lulz,” combined material from AT&T, various gaming forums, and other targets.

Operation AntiSec

On June 20, 2011, LulzSec launched “Operation AntiSec” jointly with Anonymous, explicitly targeting government and corporate networks; this banner continued in use by Anonymous-affiliated hackers after LulzSec itself disbanded, and later included the December 2011 Stratfor breach attributed to Jeremy Hammond.

Disbandment

On June 25–26, 2011, LulzSec announced its own disbandment via Twitter and a farewell statement, framing the 50-day campaign as complete, even as loosely affiliated members continued operating under the AntiSec banner.

Identified Members and Legal Outcomes

Public identities emerged only through subsequent arrests, indictments, and guilty pleas. Hector Xavier Monsegur (“Sabu”) was arrested June 7, 2011, and became a cooperating FBI informant the next day, later pleading guilty and receiving a time-served sentence in 2014. Jake Davis (“Topiary”), who ran LulzSec’s Twitter account, was arrested July 27, 2011, and sentenced in May 2013 to 24 months in a young offenders institution. Ryan Ackroyd (“Kayla”), described in court as the group’s most technically capable member, was arrested September 1, 2011, and received a 30-month sentence. Mustafa Al-Bassam (“Tflow”), 16 at the time of the offenses, was arrested in July 2011 and given a 20-month suspended sentence. Darren Martyn (“pwnsauce”) and Donncha O’Cearbhaill (“palladium”) were indicted in the US in March 2012. Cody Kretsinger and Raynaldo Rivera were separately convicted for their roles in the Sony Pictures breach, each receiving roughly one year in federal prison. One core participant, known only as “Avunit,” has never been publicly identified. Jeremy Hammond, tied to the later AntiSec/Stratfor operation rather than LulzSec's original roster, was sentenced to 10 years in federal prison in November 2013.

Timeline

• 2011-02Precursor group (Internet Feds, including future LulzSec members) breaches HBGary Federal, in an episode closely associated with Anonymous.
• 2011-05LulzSec forms and begins publicly claiming attacks, including breaches of Fox.com and PBS.
• 2011-06-02LulzSec claims a large-scale SQL-injection breach of Sony Pictures, exposing personal data on a large number of users.
• 2011-06-07Hector Monsegur ("Sabu") is arrested by the FBI; he becomes a cooperating informant the following day.
• 2011-06-14"Titanic Takedown Tuesday": LulzSec disrupts Minecraft, League of Legends, and other gaming services.
• 2011-06-15LulzSec conducts a DDoS attack against CIA.gov, taking the site offline for several hours.
• 2011-06-20LulzSec and Anonymous jointly launch "Operation AntiSec," targeting government and corporate networks.
• 2011-06-23LulzSec releases data from the Arizona Department of Public Safety under the "Chinga la Migra" campaign.
• 2011-06-25LulzSec releases its "50 Days of Lulz" final data dump.
• 2011-06-26LulzSec publicly announces its disbandment via Twitter.
• 2011-07-18News International/The Sun website is defaced with a fake story, in an action linked to former LulzSec/AntiSec participants.
• 2011-07-20Mustafa Al-Bassam ("Tflow"), 16 at the time of the offenses, is arrested in London.
• 2011-07-27Jake Davis ("Topiary") is arrested in Shetland, Scotland.
• 2011-09-01Ryan Ackroyd ("Kayla") is arrested in Mexborough, South Yorkshire.
• 2012-03-06US indictments unsealed against Davis, Ackroyd, Darren Martyn ("pwnsauce"), Donncha O'Cearbhaill ("palladium"), and Jeremy Hammond.
• 2013-04-19Cody Kretsinger is sentenced to one year in federal prison for his role in the Sony Pictures breach.
• 2013-05-14Davis, Ackroyd, Al-Bassam, and Ryan Cleary are sentenced at a UK court following guilty pleas.
• 2013-08-08Raynaldo Rivera is sentenced for his role in the Sony Pictures breach.
• 2013-11-15Jeremy Hammond is sentenced to 10 years in federal prison for the AntiSec-linked Stratfor breach.
• 2014-05-27Hector Monsegur ("Sabu") is sentenced to time served in recognition of his cooperation with the FBI.