Cardinals must give Astros top 2 picks, $2M for hacking

NEW YORK -- The St. Louis Cardinals were stripped of their top two picks in this year's amateur draft Monday and ordered to give them to Houston along with $2 million as compensation for hacking the Astros' email system and scouting database.

It was the final and unprecedented step in an unusual case of cybercrime involving two Major League Baseball teams.

Baseball commissioner Rob Manfred also banned former St. Louis executive Christopher Correa for life as he ruled the Cardinals must give the 56th and 75th draft choices in June to Houston. They must pay the Astros the money within 30 days.

Correa, the Cardinals' director of baseball development until July 2015, pleaded guilty in federal court last year to five counts of unauthorized access of a protected computer.

He was sentenced to 46 months in prison and ordered to pay the Astros $279,039 in restitution.

Then-St. Louis Cardinals scouting director Christopher Correa, left, assistant general manager Mike Girsch, center, and general manager John Mozeliak arrive at Lambert-St. Louis International Airport in 2011. Major League Baseball ordered the Cardinals to forfeit their top two picks in this year's amateur draft and pay Houston $2 million as compensation for hacking the Astros email system and scouting database. Baseball Commissioner Rob Manfred banned Correa for life on Monday and stripped the Cardinals of the 56th and 75th draft choices in June.Chris Lee ~ St. Louis Post-Dispatch via AP

"Although Mr. Correa's conduct was not authorized by the Cardinals, as a matter of MLB policy, I am holding the Cardinals responsible for his conduct," Manfred wrote. "A club suffers material harm when an employee of another club illegally accesses its confidential and propriety information, particularly intrusions of the nature and scope present here.

"In addition, as a result of Mr. Correa's conduct, the Astros suffered substantial negative publicity and had to endure the time, expense and distraction of both a lengthy government investigation and an MLB investigation."

Cardinals chairman Bill DeWitt Jr. said the "findings are fully consistent with our own investigation's conclusion that this activity was isolated to a single individual."

"This has been a long and challenging process for all of us, especially those within our baseball operations department," St. Louis general manager John Mozeliak said. "We have learned a great deal along the way, and we have taken additional steps to ensure that something like this doesn't ever happen again."

Houston said "this unprecedented award by the commissioner's office sends a clear message of the severity of these actions."

Correa was employed by the Cardinals from 2009 to 2015. When he was sentenced in July by U.S. District Judge Lynn N. Hughes, Correa said he was "overwhelmed with remorse and regret for my actions" that cost him his career and home.

"I violated my values and it was wrong. I behaved shamefully," he said then. "The whole episode represents the worst thing I've done in my life by far."

Astros general manager Jeff Luhnow said in June 2014 the team had been the victim of hackers who accessed servers and published online months of internal trade talks.

Astros general counsel Giles Kibbe said Correa accessed the Astros' system about 60 times over two years.

Federal prosecutors said in a sentencing memorandum that Correa used the password of Sig Mejdal, Houston's director of division sciences who had been the Cardinals' director of amateur draft analysis.

When he left St. Louis in December 2011, Mejdal was directed to give his computer to Correa along with its password, and Mejdal later used an almost-identical password with his Astros account.

Prosecutors said Correa had access to the Astros' system from January 2012 until June 2014 and entered the team's Ground Control database of confidential scouting reports, statistics and contract information 48 times.

He also accessed the email of five Houston employees, including that of Mejdal.

After a Sports Illustrated article that detailed the Ground Control system was published June 26, 2014, Correa the next night tried unsuccessfully to access Ground Control using the accounts of Mejdal, Luhnow, analyst Colin Wyers, manager Bo Porter and pitching coach Brent Strom.

The next morning, Correa got into Mejdal's email, found the Ground Control passwords for three Astros minor leaguers, emailed them to himself and used the passwords of two minor leaguers to enter Ground Control, prosecutors said.

Finding they had only limited access, he tried variations of passwords that previously had worked for him involving accounts of Luhnow, Mejdal, Wyers and seven other Astros officials.

Prosecutors concluded Correa leaked notes of Astros' trade discussions to Deadspin, which published them June 30, 2014.

St. Louis already had lost its original top pick, No. 19, as compensation for signing free-agent outfielder Dexter Fowler.

The Cardinals' first pick now will be No. 94 overall. Houston will have five selections in the top 94. The Astros already had slots 15, 53 and 91.