He won&#x27;t get 25 years.  But federal sentences for any type of fraud, including those issued under the CFAA, are based upon the actual or intended loss - whichever is higher.  In other words, if the government argues at sentencing that his <i>intent</i> was to seriously disrupt the entire paper&#x27;s site for an extended period of time by giving out these credentials to a known hacking group, they can claim an intended loss of millions of dollars. A sentence based upon an intended loss of more than $1 million will start at about two years and go up from there, basically depending on how the judge feels that particular day.