Jailhouse Tablets Allow Inmates to Steal Thousands of Dollars in Credits

After inmates hacked tablets with security vulnerabilities, a CenturyLink spokesperson told Threatpost the “vulnerability issue has been resolved.”

Officials at the Idaho Department of Correction say that inmates from five different facilities across the state collected nearly a quarter million dollars in credits after hacking their tablets.

Up to 364 inmates exploited a vulnerability in JPay tablets – which were given to prisoners for email, music and games – to improperly increase their account balances, officials said. The total amount stolen by all the inmates totaled nearly $225,000.

JPay is operated by CenturyLink. The service offers tablets for inmates to perform various functions – including listening to music, reading and writing emails, and playing purchased games. As part of these functions, inmates can utilize JPay Media Accounts, which offers a credit system through which they can purchase various games or eBooks.

“On July 2, the Idaho Department of Correction informed us that inmates at five institutions intentionally exploited a vulnerability to increase their JPay account balances,” a CenturyLink spokesperson told Threatpost. “This improper conduct involved no taxpayer dollars.”

CenturyLink told Threatpost that “the vulnerability issue has been resolved” – but did not answer additional requests for comment regarding the incident – including questions about what specific vulnerability the inmates were able to leverage.

The spokesperson said that the department of corrections has charged the inmates with a Class B disciplinary offense and ordered them to make restitution to CenturyLink.

Up to five facilities were impacted, the spokesperson said – including the Idaho State Correctional Institution, Idaho State Correctional Center, South Idaho Correctional Institution, Idaho Correctional Institution-Orofino, and the Correctional Alternative Placement Plan.

“This conduct was intentional, not accidental. It required a knowledge of the JPay system and multiple actions by every inmate who exploited the system’s vulnerability to improperly credit their account,” Jeffrey Ray, public information officer with Idaho’s department of correction, told Threatpost in a prepared statement.

According to Ray, 50 of the inmates had transferred at least $1,000 worth of credits to their tablets – and the largest amount that was improperly transferred were credits totaling $9,990.35. No funds from any individual or institution were transferred into the inmates’ JPay accounts.

JPay has recovered $65,318.89 worth of improper credits, Ray told Threatpost. JPay has also suspended the ability of the inmates to download music and games until they compensate JPay for its losses. The inmates are still able to use JPay to send and receive email.

Suggested articles

Discussion

  • River on

    It is a shame that a tool used to connect them to the outside world was abused and that all inmates lost access to utilities besides email. JPay's mitigation and recovery of nearly 30% of the improper funds is good news, the time between the chance of letting inmates regaining access for purchases is that much closer. There is a spelling error of "give" where it should read "five" (According to local media, up to give facilities were impacted – including the Idaho State Correctional Institution, Idaho State Correctional Center, South Idaho Correctional Institution, Idaho Correctional Institution-Orofino, and the Correctional Alternative Placement Plan.)
  • BM on

    This story would be more complete if there was a true cost accounting of the actual cost of the emails, songs, etc ... that were "stolen". The $225,000 "stolen" would probably turn out to be a few hundred dollars in in actual cost. The reality is companies like J-Pay collude with corrections officials to rip-off inmates to the tune of millions of dollars per year. I have zero sympathy for their legalized scam enterprise and hope the inmates get them for whatever they can ... and / or stop using their legalized robbery platform.

Leave A Comment

 

Subscribe to our newsletter, Threatpost Today!

Get the latest breaking news delivered daily to your inbox.