Between August and December 2024, Lane used stolen login credentials to access the computer network of a second victim company – a software and cloud storage company that served school systems in the United States, Canada and elsewhere. Lane caused personally identifying information of students and teachers stored on that company’s networks to be transferred to a computer server Lane leased in Ukraine. Later, the second victim company and others received threats that the names, email addresses, phone numbers, Social Security numbers, dates of birth, medical information, residential addresses, parent and guardian information, and passwords, among other data, of more than 60 million students and 10 million teachers would be “leak[ed] . . . worldwide” if the company did not pay a ransom of approximately $2.85 million in Bitcoin.

He was successful. The company paid the ransom. The fact that he was 18 instead of say 25 doesn't enter into what the FBI charged him with because the law doesn't care what age you are, and unfortunately, especially at the federal level it has no real way to mete out consequences to "fit the crime".

You offer no solutions, don't even have the beginnings of a way to better handle the situation (even though I can think of several that all have problems of their own including the house arrest suggestion I first posited) and this guy freely admits that he was unlikely to have stopped if he weren't arrested.

Additionally, some of that data was leaked, leading to the company offering credit monitoring for 2 years but clearly we know that that leaked data will impact the victims possibly for the rest of their lives.

It turned out that -- despite earlier assurances to the contrary -- what one state official described as a "rogue actor" tied to the original breach secretly kept some of the data.

In exchange he got 4 years in prison which is a slap on the wrist when compared to what he might have gotten as far as prison time is concerned.

Let me ask you something. Would you have them let him go? No repercussions? No consequences?