LulzSec: The 50-Day Hacking Spree That Ended With an FBI Informant

Got something to say to this podcast? Send a voicemail, and you might hear yourself on the next episode!

In the spring of 2011 a handful of anonymous hackers knocked the CIA's public website offline, pulled user data out of Sony Pictures, and planted a story on the PBS site claiming Tupac and Biggie Smalls were alive in New Zealand. They called themselves LulzSec, short for Lulz Security, and said they did it for laughs. The group formed in May 2011 from an older crew known as Internet Feds. Its leader, Sabu, was Hector Monsegur, a 29 year old unemployed IT consultant in New York. Its voice on Twitter was a British teenager called Topiary.

This episode profiles the crew, its methods, and its collapse. Most of the damage came from old, basic techniques such as SQL injection and reused passwords, which was exactly the embarrassment LulzSec wanted to inflict on careless companies. As the stunts grew, so did the ambitions and the enemies. Fifty days after it began, the group announced a cheerful retirement. The real story was a betrayal already under way.

• Kayla controlled a botnet reported at roughly 800,000 infected servers, and Tflow, a 16 year old web developer, handled the group's own operational security.
• LulzSec ran a phone line where fans could request targets, then flooded game services such as Minecraft and League of Legends with junk traffic.
• In late June the group joined Anonymous for Operation Anti-Security, hitting the UK's Serious Organised Crime Agency and leaking Arizona Department of Public Safety documents.
• Rival hackers including Team Poison and The Jester worked to unmask the members, angry at the heat they were drawing onto the whole underground.
• Monsegur had been arrested in early June after logging into a chat once without his VPN, and he kept leading the group from an FBI monitored computer while gathering evidence on his friends.