Disney Slack data theft using credentials stolen from an employee's personal computer
A Disney employee downloaded a trojanized AI art tool to a personal computer in 2024; the malware gave the attacker credentials stored on that machine, which he used to log into the employee's Disney Slack account. In May 2024 he downloaded about 1.1 TB from thousands of Slack channels, and in July 2024, claiming to be part of the hacktivist group NullBulge, released it after the employee did not respond to extortion.
- Victim
- The Walt Disney Company
- Industry
- Media and streaming
- Country
- United States
- Intrusion began
- May 2024
- First disclosed
- Jul 15, 2024
- Actor
- NullBulge (Ryan Mitchell Kramer) (Financially motivated)
- Initial access
- Stolen credentials
- Identity control that failed
- Credential storage
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
Work credentials synced to a personal, unmanaged computer put corporate access at the mercy of whatever that computer runs. Managed-device requirements for SaaS sign-in and phishing-resistant MFA would have made the stolen credentials insufficient.
Regulatory and legal outcome
Ryan Mitchell Kramer agreed to plead guilty to accessing a computer to obtain information and threatening to damage a protected computer (US Attorney, Central District of California, May 2025).
Go deeper on SWI
Sources
- Santa Clarita man agrees to plead guilty to hacking Disney employee's computer, downloading confidential data from company, US Attorney's Office, Central District of California, May 1, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Nikkei Slack workspace accessed with credentials stolen by malware 2025 · Stolen credentials
- Ticketmaster customer data stolen from its Snowflake account 2024 · Stolen credentials
- AT&T call and text records stolen from its Snowflake workspace 2024 · Stolen credentials
- Neiman Marcus customer data stolen from its Snowflake account 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). Disney Slack data theft using credentials stolen from an employee's personal computer. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-disney-slack-employee-infostealer/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.