Idaho Inmates Hacked Prison Service for $225,000 in Credit

Hundreds of prison inmates in Idaho found a way to add hundreds of thousands of dollars worth of credit to their personal accounts, officials discovered this month.

The prisoners were not inflating their bank accounts, but rather their JPay accounts. JPay is a service that inmates can use to communicate with the outside world; for example, by using secure tablets or kiosks to send emails or listen to music.

The Idaho Department of Correction learned about the hacking on July 2, and an investigation revealed that 364 inmates at five correctional facilities “had improperly credited their JPay accounts by $224,772.40,” Jeff Ray, the department’s spokesman, said in a statement.

“This conduct was intentional, not accidental,” he said. “It required a knowledge of the JPay system and multiple actions by every inmate who exploited the system’s vulnerability to improperly credit their account.”

The inmates inflated their accounts by taking advantage of a quirk in the system that did not cost taxpayers money. Of the 364 inmates, 50 credited their accounts with more than $1,000 apiece, and one person managed to accumulate nearly $10,000.

In recent years, tablets designed for prison use have become increasingly popular. JPay is one of the country’s biggest prison financial services providers and has business in dozens of states. Inmates can use JPay to communicate with family members via emails, video calls and money transfers. Some can also access music, simple games or reading materials.

“While the vast majority of individuals use our secure technology appropriately, we are continually working to improve our products to prevent any attempts at misuse,” Jade Trombetta, the company’s spokeswoman, said in an email on Thursday.

“In this case, a number of individuals were found to have improperly credited their accounts, creating credits that could be used to purchase content. Once the issue was discovered it was quickly corrected.”

Tablets have been marketed as a way to incentivize good behavior. But the companies that offer them have also been criticized for profiting from a captive market; when prisoners or their correspondents have to pay to communicate, the costs can add up. In 2014, a review by The New York Times of dozens of contracts found that states, counties and cities were seeking a substantial cut in return for letting such service businesses into prisons.

The state’s Department of Correction said that JPay had recovered more than $65,000 worth of improper credits, and the department had charged inmates with disciplinary offenses that could temporarily revoke privileges or tighten security for some.

“JPay has also suspended the ability of the inmates to download music and games until they compensate JPay for its losses,” Mr. Ray said. “The inmates are still able to use JPay to send and receive email.”