Documents unsealed last week in U.S. District Court for the southern district of Texas reveal new details about the crimes committed by former St. Louis Cardinals scouting director Chris Correa, who was sentenced to 46 months in prison for hacking into the Astros’ player information database.
The documents reveal that the Houston Astros employees whose accounts were accessed, previously unnamed in earlier records, were general manager Jeff Luhnow, special assistant to the general manager Sig Mejdal, and research and development analyst Colin Wyers.
Both Luhnow and Mejdal formerly worked with Correa on the Cardinals. The unsealed document characterizes Mejdal as “one of Correa’s rivals” and says that Correa and Mejdal had “heated disputes” while working together.
The sentencing document, which lays out the clearest overall timeline of Correa’s crimes, again says that Correa got access to Ground Control, the Astros’ database, by using an old password had Mejdal used when he was with the Cardinals.
Not only did Correa use Mejdal’s email address and password (which, amusingly, was likely a reference to David Eckstein) to log into Ground Control, he logged in directly to Mejdal’s email account.
Correa apparently gained access to all three victims’ accounts after the Astros did a system-wide password reset after Ground Control was written up in the Houston Chronicle.
Through the information released last week and earlier, one thing is clear: The Astros could have thwarted most of this by requiring all employees to enable two-factor authentication for their email and Ground Control accounts.
The sentencing document also points to a motive beyond the obviously useful scouting data: Correa was furious and envious of Mejdal’s acclaim in a June 25, 2014 Sports Illustrated cover story about the Astros’ embrace of analytics, with the cover predicting them as the winners of the 2017 World Series.
The account the feds lay out reads like a downright sinister revenge plot by Correa: On June 27, two days after the SI cover story, Correa attempted, unsuccessfully, to log into Mejdal’s, Luhnow’s, and Wyers’s Ground Control accounts. He then tried to log in via the accounts of Astros pitching coach Brent Strom and Astros manager Bo Porter. Thwarted but not deterred, he tried another tactic.
The same day, June 28, Deadspin was emailed a tip from a burner email service that linked “to a document on AnonBin, a now-dead service for anonymously uploading and hosting text files.” On June 30, Deadspin published the contents of the document, which detailed the Astros’ trade discussions between June 2013 and March 2014.
A year later, Deadspin deputy editor Barry Petchesky laid out the information we received, and why he believed we were the intended recipients. We had and have no additional information that indicates who the leaker was, and would not reveal the leaker’s identity if we knew it—as Petchesky later explained to an FBI investigator.
Regardless, the feds speculate that Correa himself emailed us the information.
Overall, the feds say Correa accessed the Astros’ data “50+ [times] in 16 months.” Correa apparently argued that he believed the Astros had proprietary information belonging to the Cardinals, but the information he accessed blows that argument away. Specifically, he spent the days leading up to the 2013 draft reviewing the Astros’ discussions and prospect rankings.
A previously unsealed document summed up the information Correa accessed as such:
The newly unsealed presentence report makes it clear:
In the same document, it says Correa was given a promotion to scouting director for the Cardinals on December 2, 2014. The feds imply that the information Correa stole from the Astros helped him get the promotion.
MLB has not yet issued a punishment for the Cardinals, but it is difficult to imagine a precedent. There is a strong likelihood the Cardinals will continue to benefit from Correa’s crimes long after his nearly four-year prison sentence is up. MLB typically takes their time issuing sanctions, and it’s probable that the league has been waiting for more documents to be unsealed to better inform their decision. However, Correa was sentenced in July 2016. Clearly, MLB wants to play this one very, very carefully.