The hack involved JPay tablets like this one, shown at a prison in New Jersey.
Hundreds of Idaho inmates exploited a vulnerability in their personal tablets and gave themselves thousands of dollars in credits used to download music and games and use email, officials said Friday.
An investigation showed more than 360 inmates hacked into the JPay system to increase their account balances by nearly $225,000 in credits, according to Jeffrey Ray, a spokesman with the Idaho Department of Corrections.
JPay, a service provided by CenturyLink, allows inmates to download games and music to portable players, the statement said.
The investigation by the state’s Department of Corrections, JPay and CenturyLink found inmates at five different Idaho correctional facilities had increased the credit on their accounts.
Fifty of the inmates gave themselves more than $1,000 worth of credits, the statement said. One inmate managed to get nearly $10,000 worth of credits, the highest amount.
“This conduct was intentional, not accidental,” Ray said in the statement. “It required a knowledge of the JPay system and multiple actions by every inmate who exploited the system’s vulnerability to improperly credit their account.”
The Idaho DOC emphasized the fact that taxpayer dollars were not involved in the hack and no real money was stolen. Inmates simply gave themselves extra credits, allowing them to purchase access to entertainment and email.
In a statement, JPay said the “vast majority of individuals use are secure technology appropriately,” noting it allows inmates access to educational programming, entertainment, and communicate with their family members.
“In this case, a number of individuals were found to have improperly credited their accounts, creating credits that could be used to purchase content,” the statement said. “Once the issue was discovered it was quickly corrected.”
So far, JPay has managed to recover $65,318.89 in the unsanctioned credits, and has suspended inmates’ ability to download music and games until the company is compensated for the losses, according to the DOC. They are still able to send and receive email.
The inmates involved have been charged with a disciplinary offense that could result in a temporary loss or privileges.
