Six hackers. Fifty days. Sony, the FBI, the CIA, the U.S. Senate—and eventually the FBI itself.

In 2011, a small group calling itself LulzSec, short for “Lulz Security,” turned hacking into a bizarre form of Internet theater. They leaked passwords, embarrassed corporations, knocked government websites offline, mocked law enforcement on Twitter, and built a following of hundreds of thousands of people.

They weren’t a giant cybercrime syndicate. They weren’t some secret NSA-level hacking unit. In fact, contemporary investigations described LulzSec as a relatively small group that relied heavily on web vulnerabilities, SQL injection, stolen credentials, DDoS attacks, and publicly available tools.

And that’s precisely what made the story so remarkable.

LulzSec demonstrated that a small group of determined hackers could create enormous publicity—and enormous damage—without the resources of a nation-state.

Then came the twist nobody saw coming.

Their charismatic leader, Sabu, had already been arrested.

And for months, he was secretly working with the FBI.

Before LulzSec, There Was Anonymous

To understand LulzSec, you have to go back to Anonymous.

By 2010 and early 2011, Anonymous had become one of the most recognizable names in hacktivism. The movement wasn’t a traditional organization with a CEO, membership list, or headquarters. It was a loose collection of hackers and activists who organized around particular causes and operations.

The HBGary Federal incident in early 2011 became one of the most notorious examples.

HBGary Federal CEO Aaron Barr had claimed that he had identified important members of Anonymous. Instead of frightening the group, the claim triggered a spectacular retaliation.

Hackers associated with Anonymous broke into HBGary systems and published stolen information.

Several people involved in that wider hacking scene would later become associated with LulzSec.

According to U.S. prosecutors, Hector Xavier Monsegur, Ryan Ackroyd, Jake Davis and Darren Martyn had previously participated in the group known as Internet Feds. In May 2011, they became principal members of a new operation: LulzSec.

The name perfectly captured their philosophy.

“Lulz” was Internet slang derived from “LOL”—laughing at somebody else’s expense.

Security was the serious part.

At least, that was the joke.

Meet the LulzSec Crew

LulzSec wasn’t a massive organization.

Contemporary reporting and later court documents describe a relatively small core group, surrounded by additional associates and people connected to Anonymous and AntiSec.

Sabu — Hector Xavier Monsegur

Sabu quickly emerged as LulzSec’s most recognizable leader.

Hector Xavier Monsegur was a 28-year-old New Yorker who had already been involved with Anonymous and Internet Feds.

Online, however, he was simply Sabu.

He was technically capable, outspoken and highly active in the group’s communications.

What nobody outside law enforcement knew was that Sabu’s story was about to take a spectacular turn.

Because on June 7, 2011, the FBI arrested him.

And instead of disappearing from LulzSec, he went back online.

As an FBI informant.

Topiary — Jake Davis

Jake Davis, better known as Topiary, became one of LulzSec’s most recognizable public voices.

He handled the group’s Twitter presence and helped write its deliberately provocative announcements.

LulzSec wasn’t just hacking.

It was performing.

Every intrusion came with a joke, a taunt, a dramatic announcement or some variation of “look what we just did.”

That combination of technical attacks and social-media theater became one of the group’s defining characteristics. Contemporary reporting noted that the group attracted hundreds of thousands of Twitter followers during its brief existence.

Kayla — Ryan Ackroyd

Ryan Ackroyd used the handle Kayla and was identified by investigators as one of the principal LulzSec members.

Unlike the colorful online persona, Ackroyd was a real person sitting somewhere in the United Kingdom.

The original claims about Kayla commanding a 24-million-PC botnet are frequently repeated in retellings of the LulzSec story, but they aren’t supported by the key court records documenting the group’s activities.

So let’s leave that number where it belongs: in the mythology.

What is well documented is that LulzSec used DDoS attacks and compromised systems as part of its operations.

Tflow — Mustafa Al-Bassam

Mustafa Al-Bassam, known online as Tflow, was another member associated with LulzSec.

He was remarkably young.

The teenager was involved in the group’s technical operations and later became one of the more unusual examples of a hacker transitioning from underground activity into legitimate technology work.

Pwnsauce — Darren Martyn

Irish hacker Darren Martyn used the name Pwnsauce.

He had previously been associated with Internet Feds and later became one of the principal members of LulzSec identified by U.S. prosecutors.

Martyn was eventually charged with computer-hacking conspiracy.

Jeremy Hammond — Anarchaos

Then there’s Jeremy Hammond.

Hammond was different from the classic “for the lulz” image.

He had a strong political and ideological motivation and later became heavily involved with AntiSec, an offshoot of Anonymous that emerged around the same period.

His most famous operation was not actually part of the original 50-day LulzSec campaign.

It came later.

And it would eventually result in a 10-year federal prison sentence.

The LulzSec Arsenal Wasn’t Magic

Here’s one of the most interesting parts of the story.

LulzSec wasn’t relying on science-fiction technology.

Their attacks often involved techniques that were already well known in the security community.

SQL Injection

SQL injection was one of the group’s most effective weapons.

A vulnerable website might take user input and insert it directly into a database query without properly validating it.

That could allow attackers to manipulate database commands and potentially access information they weren’t supposed to see.

LulzSec used SQL injection against several targets.

One of the most famous examples was Sony Pictures.

The group later mocked Sony’s security, arguing that some of its systems were vulnerable to extremely basic attacks.

The embarrassing lesson was simple:

You don’t need an elite zero-day exploit when the target hasn’t properly secured a basic web application.

DDoS Attacks

LulzSec also used distributed denial-of-service attacks, or DDoS.

Instead of breaking into a server, a DDoS attack attempts to overwhelm a service with huge amounts of traffic or requests.

The result can be simple:

The website stops responding.

That’s exactly what happened to the public CIA website in June 2011.

The Washington Post reported that LulzSec claimed responsibility for bringing the site down through a denial-of-service attack.

And suddenly the hackers had a headline that was almost impossible to resist:

Teenage hackers take down CIA website.

Stolen Credentials and Database Dumps

The other major weapon was data theft.

LulzSec broke into websites, extracted databases and published usernames, email addresses and passwords.

That made their attacks much more damaging than a simple website defacement.

It also exposed a huge problem in corporate security during that era:

Companies were still making shockingly bad decisions about password storage and application security.

May 2011: The 50 Days Begin

LulzSec officially emerged in May 2011.

One of its earliest major targets was Fox.com.

The group obtained information connected to contestants of Fox’s The X Factor USA, with prosecutors later describing the stolen data as relating to more than 70,000 potential contestants.

Then came PBS.

And this is where LulzSec’s personality became impossible to ignore.

PBS Gets the Tupac Treatment

In May 2011, LulzSec compromised the PBS website after becoming angry about a Frontline documentary concerning WikiLeaks.

Instead of simply stealing data, the hackers went for maximum entertainment value.

They published a fake story claiming that rappers Tupac Shakur and The Notorious B.I.G. were still alive and living together in New Zealand.

It was absurd.

It was also effective.

The story spread across the Internet, demonstrating one of LulzSec’s favorite tricks:

Don’t just hack the website. Control the narrative afterward.

Contemporary reporting confirmed the fake Tupac story and connected the attack to the group’s dispute with PBS coverage.

June 2011: Sony Becomes Public Enemy Number One

Then LulzSec went after Sony Pictures Entertainment.

The group claimed to have stolen information belonging to roughly one million users, while later U.S. court documents put the confirmed figure for the Sony-related LulzSec intrusion at approximately 100,000 users.

That’s an important distinction because the one-million figure is still widely repeated online.

The attack became one of the defining moments of LulzSec’s existence.

Why Sony?

Part of the hacker community was already furious with Sony following its legal battle with PlayStation 3 hacker George Hotz, better known as GeoHot.

Sony had become a symbol of corporate hostility toward the hacking community.

For LulzSec, that made the company an irresistible target.

InfraGard: Now They’re Messing With the FBI

On June 3, LulzSec hit InfraGard Atlanta.

InfraGard is a public-private partnership involving the FBI and private-sector organizations.

LulzSec stole and published credentials and other information belonging to users.

The Washington Post reported that the dump included approximately 180 usernames, passwords and email addresses.

This was a turning point.

Hacking a company was one thing.

Hacking an organization connected to federal law enforcement was another.

And the FBI was paying attention.

Then LulzSec Hit the CIA

On June 15, 2011, LulzSec announced one of its most famous victories:

CIA.gov was down.

The attack was a DDoS operation against the CIA’s public-facing website.

The important clarification is that LulzSec did not penetrate the CIA’s classified systems.

They knocked the public website offline.

But from a public-relations perspective, that distinction barely mattered.

The headline wrote itself.

The group had just demonstrated that a small hacker crew could temporarily disrupt the website of one of the world’s most famous intelligence agencies.

For LulzSec, it was comedy.

For federal investigators, it was evidence.

Nintendo and Bethesda: Yes, But We Like You

LulzSec wasn’t completely indiscriminate.

They targeted gaming companies including Bethesda and Nintendo.

But the results were different.

The group claimed an intrusion involving Bethesda and later published stolen information. U.S. prosecutors said the Bethesda intrusion involved confidential data relating to approximately 200,000 users.

Nintendo, meanwhile, became a strange example of LulzSec’s unofficial moral code.

They could attack a company while simultaneously claiming to like it.

It was classic LulzSec:

“We’re hacking you, but don’t take it personally.”

June 21: The U.S. Senate

Then came Senate.gov.

LulzSec compromised systems associated with the U.S. Senate website and published information demonstrating that the intrusion had occurred.

The Washington Post reported that the group published usernames and passwords belonging to system administrators.

At this point, the group’s target list looked ridiculous:

• Fox
• PBS
• Sony
• InfraGard
• CIA
• U.S. Senate
• Gaming companies
• Government agencies

And they were announcing everything on Twitter.

The group was no longer simply a hacking crew.

It had become an Internet phenomenon.

Operation AntiSec

As LulzSec’s 50-day campaign progressed, the group increasingly interacted with the wider Anonymous movement.

On June 20, LulzSec announced Operation AntiSec, encouraging hackers to target government and corporate systems and publish stolen information.

This was bigger than LulzSec itself.

AntiSec brought together people from LulzSec, Anonymous and other hacktivist circles.

And one of its most controversial targets was the Arizona Department of Public Safety.

The operation resulted in the publication of sensitive information belonging to law-enforcement personnel.

At that point, the consequences were no longer just embarrassing websites and angry corporations.

Real people’s information was being exposed.

That distinction would become increasingly important in the years that followed.

The 50-Day Campaign Ends

On June 25, 2011, LulzSec announced that its famous 50-day campaign was over.

The timing was almost theatrical.

The group had spent seven weeks turning hacking into a global media spectacle.

Then it simply announced:

We’re done.

The final release included a large collection of stolen material.

Contemporary reporting described a roughly 457 MB torrent containing data allegedly taken from organizations including AOL and AT&T, as well as material claimed to be connected to the FBI.

LulzSec was gone.

Or so everyone thought.

Because behind the scenes, the group had already been compromised.

The Twist: Sabu Was Already Working for the FBI

This is the part that turned the LulzSec story from a hacker comedy into a law-enforcement case study.

Hector Monsegur was arrested on June 7, 2011.

He wasn’t arrested after LulzSec disappeared.

He was arrested during the 50-day campaign.

According to reporting and later court records, investigators had identified Monsegur after he made a serious operational-security mistake by connecting to an Internet chat environment from an identifiable address.

He was facing a potential sentence of more than a century based on the charges.

So he cooperated.

And then he went back online.

The Hacker Who Was Secretly Helping the FBI

This is where the story gets almost surreal.

Sabu continued interacting with other hackers while cooperating with federal investigators.

He wasn’t merely providing information after the fact.

According to the Department of Justice, his cooperation allowed authorities to identify and locate other hackers and helped prevent or mitigate more than 300 planned or ongoing cyberattacks.

He also provided information about vulnerabilities affecting critical infrastructure.

Meanwhile, his fellow hackers still believed they were talking to Sabu.

They had no idea that their messages were reaching the FBI.

The Stratfor Operation

The most controversial chapter came later.

In December 2011, Jeremy Hammond and other members of AntiSec hacked Strategic Forecasting Inc., better known as Stratfor, a private intelligence company.

The attackers stole emails and customer information.

According to the Department of Justice, the breach affected approximately 860,000 subscribers or clients, including around 60,000 credit-card users. Some stolen card information was later used to make more than $700,000 in unauthorized charges.

Sabu had been cooperating with the FBI by then.

Court records later showed that he provided an FBI-controlled computer that was used to facilitate the publication of the stolen Stratfor material.

That’s one of the strangest details in the entire LulzSec saga:

An FBI informant was helping facilitate an operation while investigators monitored what happened.

Hammond eventually paid an enormous legal price.

The Arrests Begin

Once Monsegur was cooperating, investigators had something they rarely get in cybercrime cases:

An insider.

That information helped law enforcement build cases against people associated with Anonymous, LulzSec and AntiSec.

In March 2012, the U.S. Department of Justice unsealed charges against several alleged members.

Those included:

• Ryan Ackroyd, aka Kayla
• Jake Davis, aka Topiary
• Darren Martyn, aka Pwnsauce
• Donncha O’Cearrbhail, aka Palladium
• Jeremy Hammond, aka Anarchaos
• and Hector Monsegur, aka Sabu, whose guilty plea had been sealed.

The hacker crew that had spent weeks laughing at governments was now facing governments in court.

Jeremy Hammond Gets 10 Years

Hammond’s case became one of the most consequential.

In 2013, he pleaded guilty to conspiracy to commit computer hacking.

The Stratfor operation alone involved massive quantities of stolen information.

The Department of Justice also linked Hammond to intrusions involving government and law-enforcement organizations, including the FBI Virtual Academy and Arizona Department of Public Safety.

On November 15, 2013, Hammond was sentenced to 10 years in federal prison.

The judge also imposed three years of supervised release.

Whatever one’s opinion of Hammond’s political motivations, the case demonstrated the difference between online activism and criminal intrusion:

Once real systems and real people’s data are compromised, the consequences are very real.

And What Happened to Sabu?

Here’s the ironic ending.

The man who had presented himself as one of the most fearless hackers on the Internet ended up receiving one of the lightest sentences among the major players.

On May 27, 2014, Hector Monsegur was sentenced to time served and one year of supervised release.

He had already spent approximately seven months in prison.

The reason?

His cooperation with investigators was considered extraordinary.

The DOJ said his assistance helped identify key cybercriminals and prevent or mitigate hundreds of cyberattacks.

The hacker community, unsurprisingly, viewed the situation very differently.

Sabu had become the ultimate symbol of betrayal.

The leader wasn’t the person who brought LulzSec down.

The leader was the person who helped law enforcement dismantle it from the inside.

Why LulzSec Was So Effective

The fascinating thing about LulzSec isn’t that it possessed magical hacking technology.

It didn’t.

Its real weapon was attention.

Every attack generated publicity.

Every publicity wave attracted more followers.

Every new follower increased the group’s visibility.

And every new target created another headline.

It was a feedback loop:

Hack → publish → mock the victim → go viral → choose another target.

LulzSec understood social media before many corporations understood social media.

Twitter wasn’t simply a communication channel.

It was part of the attack.

The group turned cybersecurity incidents into entertainment.

That was new.

LulzSec Turned Hackers Into Internet Celebrities

Before LulzSec, famous hackers existed, of course.

But LulzSec helped create something different:

the hacker as an online celebrity.

They had a recognizable brand.

They had a logo.

They had a Twitter account.

They published press releases.

They joked with journalists.

They interacted directly with followers.

At one point, they even publicized a hotline where people could suggest potential targets. The Washington Post reported on the group’s use of such a hotline during the campaign.

This was cybercrime as performance art.

And modern hacktivist groups would later adopt similar tactics:

Attack something.

Claim responsibility.

Publish the evidence.

Post about it.

Move to the next target.

The Real Legacy of LulzSec

LulzSec disappeared quickly.

Its influence didn’t.

The group demonstrated several uncomfortable truths that remain relevant today.

Security by obscurity isn’t security

If a website is vulnerable, hiding the vulnerability doesn’t make it secure.

LulzSec repeatedly demonstrated that embarrassing weaknesses could be discovered by relatively small groups of attackers.

Basic security failures can have enormous consequences

Many of the attacks weren’t based on mysterious zero-day vulnerabilities.

Weak web applications, exposed credentials, poor authentication and inadequate security practices were enough to cause serious damage.

That’s an important lesson for today’s organizations.

You don’t need to defend against every theoretical attack if you haven’t fixed the obvious ones first.

Data breaches hurt people, not just companies

This is perhaps the darker side of the LulzSec story.

Behind every database dump were real users.

Email addresses.

Passwords.

Personal information.

Sometimes financial information.

The victims weren’t laughing.

The Department of Justice specifically highlighted the impact of Hammond’s operations on thousands of innocent individuals.

The “for the lulz” philosophy became much less funny when someone else’s identity or money was involved.

LulzSec Wasn’t the Beginning of Hacktivism—and It Wasn’t the End

It’s tempting to draw a straight line from LulzSec to modern ransomware groups.

That’s too simplistic.

LulzSec was primarily associated with hacktivism, data theft, DDoS attacks and online notoriety.

Modern ransomware operations are often far more organized financially, using affiliate programs, extortion platforms and professional criminal infrastructure.

The similarities are mostly cultural:

• online recruitment;
• pseudonymous identities;
• public-facing propaganda;
• data-leak websites;
• pressure through publicity;
• communities built around reputation.

The cybercrime ecosystem evolved dramatically after 2011.

But LulzSec helped demonstrate how powerful the combination of technical intrusion + media attention could become.

The Biggest Lesson: OPSEC Matters

If there’s one part of the LulzSec story that cybersecurity students should study, it’s the operational-security failures.

The group could compromise major organizations.

But protecting themselves was another matter.

Eventually, investigators connected online identities to real people.

And once Sabu was arrested and began cooperating, the entire structure became much easier to map.

The contrast is almost comical:

They could break into corporate systems, but they couldn’t reliably protect their own identities.

That’s the central paradox of LulzSec.

They weren’t defeated because somebody invented a magical superweapon.

They were defeated because people make mistakes.

And investigators only need one good mistake.

Fifty Days That Changed the Internet

LulzSec existed for an incredibly short period.

Just 50 days.

Yet during those weeks, the group managed to compromise major corporations, government-related organizations and public websites, attract a massive online audience and become one of the most recognizable hacker groups of the early 2010s.

Then it disappeared.

The members were arrested.

The trials followed.

Some went to prison.

Others eventually moved into legitimate technology and security careers.

And Sabu?

He went from Internet folk hero to FBI informant, ultimately receiving time served because of the extraordinary value of his cooperation.

That’s the part that still makes the LulzSec story so strange.

They wanted to embarrass governments.

They wanted to expose weak security.

They wanted attention.

They wanted the lulz.

Instead, they discovered one of the oldest rules in cybersecurity:

You can spend weeks attacking other people’s systems, but eventually someone will start investigating yours.

LulzSec didn’t conquer the Internet.

It simply demonstrated how fragile the Internet could be—and how quickly a small group of hackers could turn technical vulnerabilities into a global spectacle.

And then, almost exactly as dramatically as it began, the LulzSec era ended.

Fifty days of chaos.

Years of prison sentences.

And one FBI informant who had been sitting in the middle of the entire operation.

Not bad for a group that started with four words:

Lulz Security.

Sources

• U.S. Department of Justice — LulzSec charges and investigation
• U.S. Department of Justice — Hector Monsegur sentencing
• U.S. Department of Justice — Jeremy Hammond sentencing
• The Guardian — Why LulzSec went on the attack
• The Guardian — LulzSec: what they did, who they were and how they were caught
• The Washington Post — CIA Web site hacked
• Ars Technica — LulzSec hackers and the FBI investigation