NEW YORK – Major League Baseball ruled Monday that the St. Louis Cardinals must give their top two 2017 draft picks to the Houston Astros and pay Houston $2 million for hacking into the Astros' database.
Chris Correa, ex-scouting director for the Cardinals, was sentenced in July 2016 to nearly four years in prison after he pleaded guilty to five counts of unauthorized access of a protected computer. He was also ordered to pay the Astros nearly $280,000 in restitution.
Correa used a variation of an old password used by a former Cardinals employee who joined the Astros. Correa gained access to the Astros employee's email as well as Ground Control, the team's scouting database containing evaluations of prospects, potential draft picks and trade targets, in 2013 and 2014.
MLB commissioner Robert Manfred said in Monday's ruling that the "Astros suffered material harm" as a result of the hacking and "suffered substantial negative publicity" while also having to endure "time, expense and distraction of both a lengthy government investigation and an MLB investigation."
The Cardinals will have to give up their 2017 second-round pick (no. 56) in the First-Year Player Draft, as well as their Compensation Round B selection (no. 75). The Redbirds will have to pay the Astros the $2 million within 30 days of Monday's ruling.
MLB's ruling Monday said no other Cardinals employee besides Correa was responsible and that no other employees or former employees will be disciplined.
The #Astros have released the following statement: pic.twitter.com/t4wLxc4WMR
— Houston Astros (@astros) January 30, 2017
The Astros released a statement Monday that read, "The Houston Astros support MLB's ruling and award of penalties. This unprecedented award by the Commissioner's Office sends a clear message of the severity of these actions. Our staff has invested a great deal of time in support of the government, legal and league investigations and are pleased to have closure on this issue. We are looking forward to focusing our attention on the 2017 season and the game of baseball."
Cardinals chairman and CEO William O. DeWitt Jr. told MLB.com, "We respect the Commissioner's decision and appreciate that there is now a final resolution to this matter. Commissioner Manfred's findings are fully consistent with our own investigation's conclusion that this activity was isolated to a single individual."
"This has been a long and challenging process for all of us, especially those within our baseball operations department," St. Louis general manager John Mozeliak told the Associated Press. "We have learned a great deal along the way and we have taken additional steps to ensure that something like this doesn't ever happen again."
St. Louis already had lost its original top pick, No. 19, as compensation for signing free-agent outfielder Dexter Fowler. The Cardinals' first pick now will be No. 94 overall. Houston will have five selections in the top 94. The Astros already had slots 15, 53 and 91.
New documents shed light on extent of hacking
In a recently unsealed court document, prosecutors said Correa accessed Ground Control 48 times over 2 1/2 years. Court documents said Sig Mejdal, who left the Cardinals along with Jeff Luhnow to join the Astros, was ordered to hand over the password to his laptop when he left.
Correa, in his plea agreement, admitted to successfully using a variation of that password to access Mejdal's Astros email account in March and June 2014.
The documents said Correa had access to everything that Mejdal, head of the Astros' analytics team, read and wrote.
Court documents allege that Correa was jealous of the attention that the Astros farm system, as well as Mejdal and Luhnow, received in a June 2014 Sports Illustrated issue whose cover proclaimed that Houston would win the 2017 World Series, and that Correa the following night tried unsuccessfully to log into the Ground Control accounts of Mejdal, Luhnow, Astros' analyst Colin Wyers, Astros pitching coach Brent Strom and Astros' manager Bo Porter.
PHOTOS: Principals involved in hacking scandal
The next morning Correa hacked into Mejdal's Astros email account and found the user names and passwords of three Houston minor-league players, then logged into Ground Control using two of the accounts, court documents said.
Confidential information about recent Astros' trade discussions were leaked to sports blog site Deadspin.com the next day. Court documents allege that Correa, after "stewing overnight," was the likely source of the leak.
The story gained national attention and the Astros had to privately apologize to every team in the league, since several players were reported to be the subjects of trade discussions.
Prosecutors said Correa tried to conceal his steps and his identity using several different tools.
Correa was employed by the Cardinals from 2009-15. When he was sentenced last July by U.S. District Judge Lynn Hughes, Correa said he was "overwhelmed with remorse and regret for my actions" that cost him his career and his home.
"I violated my values and it was wrong. I behaved shamefully," he said then. "The whole episode represents the worst thing I've done in my life by far."
Manfred banned Correa from baseball for life.