The US Attorney's office in Manhattan charged Behzad Mesri, also known as “Skote Vahshat,” with a role in the hack that simultaneously enraged and captivated fans of the show during its seventh season.
Mr Mesri is a member of the Turk Black Hat Security hacking team who has worked for the Iranian military on other computer attacks, prosecutors said.
Prosecutors allege Mr Mesri hacked into HBO’s computer system via employees' user accounts starting in May of this year. Along with the Game of Thrones scripts, he also accessed unaired episodes of Ballers, Room 104, and Curb Your Enthusiasm, as well as a number of internal emails and financial documents. At one point, prosecutors said, Mr Mesri bragged he had stolen 1.5 terabytes of data.
In July, he allegedly began sending taunting messages to HBO executives, demanding $5.5m in Bitcoin in exchange for not releasing the episodes. The demand was later increased to $6m.
"Hi to all losers!" one email read. "Yes it's true! HBO is hacked … Beware of heart attacks."
In what Acting US Attorney Joon Kim called a “flair for the dramatic,” Mr Mesri allegedly included doctored images of Game of Thrones characters, such as the Night King, in his emails. Later, he allegedly posted a screenshot of the HBO logo online, with the words, “Winter is coming. HBO is falling,” added to the bottom. The addition is a reference to the show’s catchphrase.
Mr Mesri has been charged with computer fraud, wire fraud, extortion, and identity theft, but has not been arrested. The FBI has been unable to arrest him because he remains in Iran, Mr Kim said on Tuesday. Nevertheless, the attorney said, the indictment sent a message to Mr Mesri and all other hackers that “they are not safe behind the anonymity of computer screens”.
“These charges will follow [Mr Mesri] wherever he goes, until he is caught and brought to justice,” Mr Kim added.
The attorney refused to say whether he thought Mr Mesri was working on behalf of the Iranian government at the time of the hack. The indictment only states that he has worked for the government in the past. Mr Kim noted, however, that many of the emails appeared to come from a collective “we”.
Mr Kim was unambiguous in accusing the Iranian government of employing alleged criminals to launch cyber attacks on the US. Just last year, he noted, the federal government charged seven Iranians with carrying out a cyber attack on dozens of US banks on behalf of the Iranian government.
“This is a reminder that our country and our businesses remain prime targets of hackers around the world,” Mr Kim said of the HBO hack.
In closing, he added: “Today, winter has come for Behzad Mesri.”