Kyle Svara, a 27-year-old Illinois man, was sentenced on July 21 to 76 months in federal prison for hacking Snapchat accounts to steal, keep, sell, and trade private images. District Judge Brian Murphy in Boston following Svara’s guilty plea to charges of computer fraud, aggravated identity theft, and making a false statement to law enforcement regarding the presence of child pornography on his online accounts.
The Phishing Scheme and Victim Impact
Between May 2020 and February 2021, Svara executed a widespread phishing campaign. According to reports from Reuters, he utilized anonymized, internet-based phone numbers to transmit text messages to more than 1,500 women, masquerading as the support team for the social media platform Snapchat.
The scheme relied on the cooperation of victims who, believing the messages were legitimate security alerts, provided the security codes necessary for Svara to bypass account protections. Prosecutors reported that Svara successfully breached the accounts of at least 517 women. Once inside, he accessed stored media, specifically targeting nude and semi-nude photographs. Records indicate he obtained such content from at least 59 of the compromised accounts. Attorney Leah Foley, whose office prosecuted the case.
Connection to Northeastern University Coach Case
Svara’s criminal activity intersected with an earlier federal investigation involving Steve Waithe, a former track-and-field coach at Northeastern University. Prosecutors revealed that Svara advertised his hacking services online, where he was paid $50 by Waithe to breach the accounts of specific women, including athletes Waithe had previously coached. Waithe sought to steal content from these women to satisfy his own schemes.
Waithe was sentenced in 2024 to five years in prison for his role in schemes designed to dupe young women into sending him nude photos or to steal such images from them. Prosecutors have stated that Waithe victimized at least 56 women nationally. Svara’s 76-month sentence accounts for his involvement in these activities. Regarding the child pornography found on his accounts, Svara had originally made a false statement to law enforcement claiming he had no interest in such material.
Defense Arguments and Legal Context
In court filings, Svara’s defense team characterized his actions as occurring during a period of isolation while he was a student at the University of Illinois, staying at home during the COVID-19 lockdown. His attorneys stated that he has expressed profound remorse and shame for his actions.
A lawyer for Svara did not respond to requests for comment regarding the sentencing.
This case reflects a broader history of account-compromise schemes targeting personal data. In an earlier legal matter involving similar techniques, a 36-year-old Pennsylvania man named Ryan Collins was charged with hacking Apple iCloud and Gmail accounts between November 2012 and September 2014. According to court filings, Collins utilized fraudulent email addresses designed to look like legitimate security accounts from various internet service providers.
“[The] defendant used numerous fraudulent email addresses designed to look like legitimate security accounts from various internet service providers, including, for example, [email protected], [email protected] and [email protected],”
Court filings
The case involving Collins involved more than 100 accounts, including at least 50 iCloud and 72 Gmail accounts. Prosecutors in that case noted that the defendant accessed full Apple iCloud back-ups belonging to numerous victims, including at least 18 celebrities, many of whom reside in the Los Angeles area.
Court papers state that many of these back-ups contained nude photographs and videos. While prosecutors in the Collins case recommended a jail term of 18 months, they noted that a judge could extend that sentence to five years, further illustrating the varying legal consequences for those who leverage phishing to steal private digital content.