LulzSec: public spectacle and private cooperation
2011–2014
Reviewed 2026-10-16

The group’s brief period of public attacks was followed by a longer sequence of prosecutions. Individual admissions and outcomes are more precise than a single label for everyone associated with the name.

2011: a group becomes a public identity
The Justice Department’s later account places LulzSec’s formation in May 2011 and describes attacks against media, government, and corporate systems. It identifies Hector Monsegur, known publicly as Sabu, as a leading participant. Claims about particular attacks are attributed to that account; the catalog does not treat an online boast as independent proof.
Source: U.S. Attorney, Southern District of New York — 2014 case account
https://www.justice.gov/usao-sdny/pr/leading-member-international-cybercriminal-group-lulzsec-sentenced-manhattan-federal

2013: an individual conviction
Cody Kretsinger, using the name recursion, was sentenced in April 2013 to one year and one day in federal prison in the Sony Pictures case. This is an individual legal outcome concerning a particular intrusion, not a verdict on everyone who used the LulzSec name. The incident involved people’s data as well as an organization’s systems; recounting it does not require republishing the stolen material.
Source: U.S. Attorney, Central District of California — Kretsinger sentencing
https://www.justice.gov/usao-cdca/pr/member-lulzsec-hacking-group-sentenced-over-year-federal-prison-2011-intrusion-sony

2014: cooperation changes the outcome
Monsegur had pleaded guilty in August 2011. In May 2014 he received time served and one year of supervised release. Prosecutors credited his cooperation with helping identify other participants and prevent attacks. Those assessments explain the government’s sentencing position; they are not a license to infer that unrelated community members were informants.
Source: U.S. Attorney, Southern District of New York — Monsegur sentencing
https://www.justice.gov/usao-sdny/pr/leading-member-international-cybercriminal-group-lulzsec-sentenced-manhattan-federal

The unresolved historical questions
Contemporary reporting also examined the conduct of the investigation, including the role of an informant during later activity. This creates a second historical question alongside the prosecuted intrusions: how investigators manage cooperation without obscuring responsibility. The archive identifies that reporting as reporting, rather than converting its interpretation into a court finding.
Source: The Guardian — reporting on released chat records, October 2014
https://www.theguardian.com/us-news/2014/oct/14/fbi-informants-role-hacking-sun-newspaper-lulzsec-chat-logs

Historical and educational reporting, not operational guidance or legal advice. Allegations are identified as allegations; charges are not convictions. A plea or judgment applies to the identified person and conduct, not to every associate, reader, or community. Source inclusion is not endorsement. This account is limited to the cited record and may be corrected as reliable evidence changes.