League of Legends hacker Shane Duffy avoids jail for selling access to 5 million gamers' accounts

A man from Queensland, Australia has avoided a jail term after he pleaded guilty on Thursday (30 June 2016) to selling access to millions of hacked user accounts from popular online game League of Legends.

Shane Stephen Duffy, 23, from Queensland, faced nine computer-hacking and fraud charges after targeting US firm Riot Games – the developer of the online multiplayer phenomenon League of Legends – which boasts more than 60 million players every month.

As reported by ABC News, prosecutor Joshua Hanna explained to Brisbane's District Court how Duffy was able to exploit a 2011 cyberattack for his own financial gain.

At the time of the initial breach, an unknown hacker stole account details of more than million users. While Duffy was not deemed responsible for the first attack, he was guilty of obtaining the data and selling access to the accounts, the court ruled.

The court heard how, between May 2013 and March 2014, Duffy was able to make more than 190 separate transactions worth a total of $32,000 (£17,700). The stolen details could be used by buyers to target gamers' IP addresses, launch distributed-denial-of-service (DDoS) attacks or cheat in the game.

Judge Tony Moynihan branded the online offences as "very serious". Speaking during the court hearing, he told Duffy: "You achieved this by exploiting other confidential data belonging to Riot Games that was in your unauthorised possession.

"This type of crime potentially affects many people, can cause great loss and is difficult to detect, investigate or prosecute. Your offending was sophisticated, [and] committed over a lengthy period of time."

The court also heard how Duffy hacked into a Twitter account belonging to Riot Games president Marc Merrill to "publicise" his illicit service while teaming up with other "online associates" to disrupt League of Legend players. Furthermore, Duffy, who suffers from Asperger's Syndrome, was found to have sent a number of threatening letters to the company.

The defence argued that Duffy was a recluse who had a limited education. This, according to his lawyer Patrick Wilson, left his client "unable to comprehend the consequences of his actions". In response, the judge sentenced Duffy to a two-and-a-half-year jail term, but the defendant was granted immediate parole.

In an in-depth look at the Riot Games hack by The Daily Dot from 2014, Duffy is featured heavily, and appears to admit to having been complicit in the two separate attacks against Riot Games.

Additionally, in one interview with The Australian newspaper from the same year, Duffy's mother and carer defended her son. She said: "What the police are saying is not correct [...] he's not guilty of the charges he's accused of. Shane's capable, but then the information he had and accessed was freely available on the internet. Somebody else has thrown the database out there."