Romanian hacker Guccifer who revealed George W Bush paintings and Hillary Clinton's email address pleads guilty

Notorious Romanian hacker Guccifer pleaded guilty to two hacking-related charges on 25 May, including unauthorised access to a protected computer and aggravated identity theft. Prosecutors said Guccifer, whose real name is Marcel Lehel Lazar, hacked into the email and social media accounts of 100 Americans, including former presidents George H W Bush and George W Bush.

"Cybercriminals like Marcel Lazar believe they can act with impunity from safe havens abroad, but the Justice Department's partnerships with law enforcement agencies around the world ensure that they can be brought to justice," Assistant Attorney General Caldwell said in a statement. "Lazar sought fame by hacking the private online accounts of Americans and releasing their personal information to the public; instead, he has been convicted in United States federal court."

Lazar, a former taxi driver, rose to notoriety after hacking into email accounts associated with the Bush family, resulting in leaked emails, photographs, home addresses, telephone numbers and medical information. Some of the hacked photos, which included nude self-portraits of George W Bush and a photo of George H W Bush in the hospital, were sent to several media outlets and were published by The Smoking Gun.

Lazar's other victims included a "family member of two former US presidents, a former US cabinet member, a former member of the US Joint Chiefs of Staff and a former presidential adviser", the press release states.

He was also the first person to expose US presidential candidate Hillary Clinton's private email address when she was the secretary of state. He recently claimed to have gained access to Clinton's "completely unsecured" private server as well.

As part of the plea bargain, several other counts were dropped, including cyberstalking and wire fraud. The hacker reportedly used relatively low-tech techniques such as guessing passwords and security questions to gain access to his victims' email and social media accounts.

In June 2014, Lazar was indicted by a federal grand jury on charges of unauthorised access to a protected computer, wire fraud, aggravated identity theft, cyberstalking and obstruction of justice, according to a press release from the US Attorney's Office for the Eastern District of Virginia. He was also convicted of similar charges in Romania the same year. He was serving a four-year sentence before his home country approved his extradition in March 2016. He made his initial court appearance on US soil on 1 April.

"Mr. Lazar violated the privacy of his victims and thought he could hide behind the anonymity of the Internet," Dana J. Boente, US attorney for the Eastern District of Virginia, said in a statement at the time of his extradition. "No matter where they are in the world, those who commit crimes against U.S. citizens will be held accountable for their actions, pursued by our investigators and prosecutors and brought to justice."

Lazar will serve a minimum of two years in prison and could face a possible maximum of seven years when he is sentenced in September. The plea deal will reportedly allow him the possibility of serving some of his sentence in Romania.