Idaho inmates hack prison system and steal $225,000 in credits

Hundreds of Idaho prison inmates have hacked jail software to "artificially" boost the amount of money in their own accounts, officials say.

The Idaho Department of Corrections said 364 inmates were "intentionally exploiting a vulnerability" to take nearly $225,000 (£171,000).

Fifty prisoners credited their accounts with more than $1,000 each while another inmate transferred $9,990.

A prisons spokesman said the "improper conduct involved no taxpayer dollars".

In a statement to BBC News, Idaho Department of Correction spokesman Jeff Ray said the inmates had hacked the JPay system.

JPay is a private firm that allows US prisoners access to portable devices which can transfer money, download music and games, and exchange communications with family members.

Mr Ray said the inmates had manipulated the JPay system so it would increase the amount of money credited to them.

No funds from any individual or institution were transferred into the prisoners' accounts.

"This conduct was intentional, not accidental," said Mr Ray.

"It required a knowledge of the JPay system and multiple actions by every inmate who exploited the system's vulnerability to improperly credit their account."

Prisoners from four state institutions and one private prison were discovered to have taken part in the scheme earlier this month.

In a statement to the Associated Press (AP), JPay spokeswoman Jade Trombetta said the company "is proud to provide services that allow incarcerated individuals to communicate with friends and family, access educational programming, and enjoy positive entertainment options that help prevent behavioural issues".

"While the vast majority of individuals use our secure technology appropriately, we are continually working to improve our products to prevent any attempts at misuse."

Mark Molzen, a spokesman for internet provider CenturyLink, which supports JPay, said the vulnerability in the software had been fixed but declined to explain how the transfers occurred.

JPay has so far recovered more than $65,000 worth of credits from the prisoners.

They have been suspended from downloading music and games until they pay the company for its losses, but they are still able to send and receive emails.

The Idaho Department of Corrections has also issued disciplinary reports to the inmates that were involved, meaning that they would lose certain privileges and be reclassified to a higher security risk level.