US charges alleged extortionist with demanding $150K from MLB

The FBI got involved after the defendant appeared to threaten an MLB executive.

U.S. prosecutors have charged a 30-year-old man with attempting to extort Major League Baseball and broadcasting illegal game streams after he allegedly breached the league’s website.

Attorneys from the Southern District of New York charged Joshua Streit with running HeheStreams.com, a website that allowed users to stream games from the MLB, National Hockey League, National Basketball Association and the National Football League for a fee, according to a complaint. The site attracted a sizable following on social media and discussion forums like Reddit, where fans congregated to praise the cheap prices HeheStreams offered in comparison to the leagues’ official streaming services, the Wall Street Journal reported.

In March 2021, prosecutors say, Streit contacted MLB personnel to complain about “a lack of gratitude” after he alerted the organization about a “network vulnerability.” Streit allegedly requested $150,000 from the MLB in exchange for his apparent disclosure. An MLB executive responded to Streit by saying the league does not have a bug bounty program, in which an organization rewards an outsider for reporting legitimate security issues, an increasingly common model in the private sector.

Streit responded by saying “MLB should have a bug bounty program for situations like this and that it would be bad if the media found out about the network vulnerability and embarrassed MLB,” according to the complaint. He is now charged with knowingly accessing a protected computer and sending interstate threats with an intent to extort.

CyberScoop could not immediately locate an attorney for Streit for comment.

During its heyday Hehestreams functioned as one of the top illicit stream services, an increasingly rare relic from an era before widespread paid streaming services. Users could subscribe via an $100 Amazon gift card, using a method that relied on PayPal to avoid any financial transactions that investigators might monitor.

“One of the ways I’ve stayed alive is by avoiding a paper trail,” the anonymous owner told the Verge in March. “My predecessors were thriving for some time, but their payment processor kept getting tipped off and they’d stop processing their money.”

The MLB now says that Hehestreams cost it $3 million in lost revenue.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure