HOUSTON — A federal judge sentenced the former scouting director of the St. Louis Cardinals to nearly four years in prison Monday for hacking the Houston Astros’ player personnel database and email system in an unusual case of high-tech cheating involving two Major League Baseball clubs.
Christopher Correa had pleaded guilty in January to five counts of unauthorized access of a protected computer from 2013 to at least 2014, the same year he was promoted to director of baseball development in St. Louis. He was fired last summer and now faces 46 months behind bars and a court order to pay $279,038 in restitution. He had faced up to five years in prison on each count. Correa will remain free on bond until he reports to federal prison within about six weeks.
Correa read a letter in court before he was sentenced by U.S. District Judge Lynn N. Hughes and he said he was “overwhelmed with remorse and regret for my actions” that cost him his career and his home.
“I violated my values and it was wrong. I behaved shamefully,” he said. “The whole episode represents the worst thing I’ve done in my life by far.”
The judge scolded Correa for his continued blaming of the Astros for his actions, saying Correa was acting like he was in middle school. Hughes did not elaborate on this information — part of a sealed presentencing report — but when he pleaded guilty in January, Correa had maintained he found proprietary Cardinals’ information in the Astros’ database.
Hughes said Correa’s actions were primarily about a loss of trust.
“The loss is that every baseball team has much tighter security, making it harder for honest people to go about their daily lives … A lot of little people whose lives were adversely affected by the cost taken to defend against people like you,” Hughes said.
MLB Commissioner Rob Manfred could discipline the Cardinals, possibly with a fine or a loss of draft picks, but has said only that he looked forward to getting details on the case from federal authorities.
“Now that the criminal process has been completed, Commissioner Manfred has asked the Department of Investigations to conduct a complete investigation of the facts in this matter, including requesting information from the appropriate law enforcement authorities,” the league said in a statement. “The commissioner hopes that the investigation can be completed promptly to put him in a position to take appropriate action.”
Cardinals Chairman Bill DeWitt Jr. had blamed the hack on “roguish behavior” by a handful of individuals.
“As we did with the government during its investigation, we intend to fully cooperate with the commissioner’s office in connection with its investigation so that this matter can finally be resolved,” DeWitt said in a statement Monday.
Kenneth Magidson, the U.S. Attorney in Houston, said he was pleased with the sentence, which he added concludes his office’s investigation. No one else was charged in the case.
“This is a very serious offense and obviously Judge Hughes saw it as well,” Magidson said.
Giles Kibbe, the Astros’ general counsel, called it “a sad day for baseball.” He added that despite what Correa had claimed, the Astros were not using any proprietary information from the Cardinals.
“The Astros were the victim in this case,” Kibbe said.
The data breach was first reported in June 2014 when Astros general manager Jeff Luhnow told reporters the team had been the victim of hackers who accessed servers and published online months of internal trade talks. Luhnow had previously worked for the Cardinals.
Federal prosecutors say the hacking cost the Astros about $1.7 million, taking into account how Correa used the Astros’ data to draft players. Kibbe said that in the two years Correa was in the Astros’ system, he accessed the team’s network about 60 times.
The FBI said Correa was able to gain access using a password similar to that used by a Cardinals employee who “had to turn over his Cardinals-owned laptop to Correa along with the laptop’s password” when he was leaving for a job with the Astros in 2011. The employee was not identified, though Luhnow left St. Louis for Houston in December of that year to become general manager.
Prosecutors have said Correa in 2013 improperly downloaded a file of the Astros’ scouting list of every eligible player for that year’s draft. They say he also improperly viewed notes of trade discussions as well as a page that listed information such as potential bonus details, statistics and notes on recent performances and injuries by team prospects.
The Astros rely heavily on sabermetrics in their evaluation of players and use a database called Ground Control to house proprietary information.
Authorities say that after the Astros took security precautions involving Ground Control following a Houston Chronicle story about the database, Correa was able to still get into it. Authorities say he hacked the email system and was able to view 118 pages of confidential information, including notes of trade discussions, player evaluations and a 2014 team draft board that had not yet been completed.
Luhnow was a key figure in the Cardinals’ own database, called Redbird. At least one former Cardinals employee — Sig Mejdal, a former NASA employee and analytics expert — had joined Luhnow in Houston.
Luhnow has not commented in detail about the case, though he’s denied using any of the Cardinals’ intellectual property or information from Redbird to create Houston’s database.
The Cardinals are among baseball’s most successful franchises on and off the field. Only the New York Yankees have more World Series titles than the 11 won by St. Louis. The Astros and Cardinals were rivals in the National League Central until Houston moved to the American League in 2013.
JUAN A. LOZANO