Inmates in Idaho Hacked Their Prison Tablets and Siphoned $250k in Credits

Inmates in Idaho used tablets to siphon close to a quarter million dollars. That’s 364 inmates to be exact, from five different correctional facilities (four state institutions and one private prison), that exploited a vulnerability in tablets made specifically for prisons to collectively transfer $225,000 into their own accounts.

The tablets are made by a company called JPay and allow inmates to use email, purchase and listen to music, and play games. But inmates were able to manipulate JPay’s digital credits system and increase the amount of money credited to their accounts, many in amounts exceeding $1,000 – overall, 50 inmates were able to transfer over a thousand dollars each; the largest amount credited by a single inmate was just under $10,000.

To be clear, those tablets employ virtual credits as their currency. The credits are converted from actual funds, which are typically transferred by the inmates’ relatives.

Hack or Glitch?

Idaho Department of Correction spokesman Jeff Ray said that “this conduct was intentional, not accidental. It required a knowledge of the JPay system and multiple actions by every inmate who exploited the system’s vulnerability to improperly credit their account.”

The nature of the vulnerability hasn’t been disclosed yet – officials say it was an “intentional exploitation,” some of the inmates’ families prefer to call it a “glitch” – but is said to have already been fixed.

Officials didn’t discover the vulnerability until early July and have so far been able to recover $65,000. Meanwhile, JPay has suspended the ability to download music and games until it is compensated for its losses; inmates are still able to send and receive emails, however.

The Idaho Department of Correction has also issued disciplinary offense reports against the suspected inmates. Those found guilty run the risk of losing privileges and may even be reclassified to a higher security risk level.

Monetizing Incarceration

JPay may seem to be doing a noble deed, but it’s really not. Using JPay is expensive, sending an email costs close to half a dollar. Some inmates would have to work five hours at 10-cents-an-hour prison jobs to be able to send just one email. JPay is also the only email provider available to the inmates.