Kentucky Prisoners Take Advantage of Securus Software Glitch for $1 Million
On August 24, 2024, Kentucky’s Lexington Herald-Leader reported that prisoners at several state prisons took advantage of a software vulnerability in state-issued Securus Technologies tablets to fraudulently create over $1 million in digital credits. The counterfeit funds were used to purchase email stamps, video visits and entertainment like games, music, and movies.
The hack occurred in late 2022, but it wasn’t discovered until an anonymous tip on January 3, 2023; by that time, prisoners had spent nearly $88,000 of stolen credits on digital products. According to internal investigative records from the state Department of Corrections (DOC), 366 prisoners were involved, primarily at Luther Luckett Correctional Complex. A new app installed on the state-issued tablets on December 9, 2022, was blamed; designed to allow prisoners to transfer money between their commissary accounts and their Securus accounts, it also allowed the latter account to be inflated with money that was “created” simply by entering a negative amount in the transfer form; prisoner LaDaniel Brown discovered that this resulted in credits to both accounts with funds that didn’t actually exist. Brown, serving 30 years for child sex abuse, admitted to taking part in the hack.
The fraudulent transactions went largely unnoticed because purchases in Securus accounts occurred digitally without direct oversight that commissary purchases typically receive. Prisoners quickly shared the hack, leading to a surge in spending on Securus products. “Inmate Brown also admitted to how easy it was,” internal investigators noted in their report.
DOC and Securus struggled for months to determine which purchases were made with fraudulent funds and recover the losses. The state placed liens on some prisoners’ commissary accounts and barred their access to tablets or phone services until the debts were paid.
In some instances, officials acted quickly to recoup funds from prisoners who were about to be released. Despite the scale of the fraud, DOC chose not to impose severe punishments, instead suspending disciplinary segregation sentences, provided no further infractions occurred.
Securus is not the first prison profiteer compromised by hackers: In 2018, Idaho prisoners hacked tablets from JPay, a related company, to steal $225,000 the same way. Despite this history of vulnerabilities, Securus, owned by private equity firm Platinum Equity, is a major player in the prison telecom market, charging excessive fees for services like email, as reported elsewhere in this issue. [See: PLN, Nov. 2024, p.12.] The firm has also paid $22.3 million in kickbacks to Kentucky, according to information obtained under the Open Records Act.
Source: Lexington Herald-Leader
As a digital subscriber to Prison Legal News, you can access full text and downloads for this and other premium content.
Already a subscriber? Login