On January 30th, Major League Baseball (MLB) handed down punishment to the St. Louis Cardinals for their involvement in the hacking of the Houston Astros’ network and player database by the Cardinals’ former Director of Scouting, Chris Correa. St. Louis will be forced to send its first two draft picks (Nos. 56 and 75) in the 2017 amateur draft to Houston along with $2 million. Commissioner Rob Manfred’s punishment ends a nearly two-year investigation into the unprecedented scandal involving one of baseball’s model franchises.

How We Got Here

Jeff Luhnow (pictured below) was hired as the vice president of player development by St. Louis in 2003. From 2003 until 2011, Luhnow revamped the Cardinals’ scouting department and farm system into one of the best systems in MLB. In 2011, Luhnow was hired by the Houston Astros to be their General Manager taking much of his staff and data with him.

unknown-1Chris Correa was hired by the Cardinals in 2009 and worked in Luhnow’s department until Luhnow departed for Houston. Correa was promoted to Director of Scouting in 2014.

In June of 2015, the New York Times published a story describing an ongoing FBI investigation into the alleged hacking of the internal network of the Houston Astros’ by front office members of the St. Louis Cardinals in an attempt “to wreak havoc on the work of Jeff Luhnow.”

Shortly after the story broke, Chris Correa became the center of the investigation. Correa admitted to using the login information Luhnow and his staff used during their time in St. Louis to gain access to the Houston network in order to determine whether the Astros had stolen proprietary data. St. Louis subsequently fired Correa in July of 2015.

In January of 2016, Correa pled guilty to five counts of unauthorized access to a protected computer and was ordered to pay $279,038 in restitution. Part of the plea agreement required Correa to admit to using the accounts of three Astros employees to view sensitive and confidential information. The information Correa became privy to when accessing these accounts included scouting reports, trade discussions, and draft strategy.

Correa maintains that he did find evidence of Cardinal property in the Houston database, but because he obtained it via illegal methods, he was reluctant to discuss this with investigators or MLB.

U.S. District Court Judge Lynn Hughes followed the request of the federal prosecutors and handed Correa a 46-month prison sentence in July of 2016. It is important to note that Correa “may receive a term of supervised release after imprisonment of up to [three] years,” according to the plea agreement posted by the Department of Justice.

MLB Sanctions

MLB and Rob Manfred took this as an opportunity to address teams about the issue of cyber security and the growing need to protect their intellectual property. Commissioner Manfred was also faced with punishing the Cardinals in a way that would be fair and deter this type of behavior in the future.

Ultimately, Manfred decided on giving Houston St. Louis’ first two picks in the 2017 draft along with $2 million. This punishment has been criticized as being far too light. However, a careful analysis of the sanctions suggests several reasons the punishment is more than adequate and will deter future incidents.

St. Louis owner Bill DeWitt Jr. and General Manager John Mozeliak (pictured below) maintained throughout that this was an isolated incident and team personnel outside of Correa had no knowledge of his activities. However, Manfred explained that “as a matter of MLB policy” he would hold the Cardinals vicariously liable for Correa’s misconduct. While Correa was an employee of the Cardinals and there is a level of responsibility
unknownthe team has for his actions, imposing a stiffer penalty on a team because of a single rogue employee is a tough sell. If ownership or the GM were directly involved or had knowledge of what Correa was doing, a much stiffer punishment would be justified and very necessary.

During the investigation, the U.S. Attorney’s office valued the knowledge gained by Correa at $1.7 million. While it is difficult to place an exact dollar amount on a team’s scouting reports, data analysis, etc., it is significant that the federal investigation valued it at $1.7 million. The Cardinals were ordered to pay the Astros $2 million (the max penalty allowed by the current CBA) on top of the draft picks that also went to Houston.

Finally, the draft picks going to Houston carry with them bonus pool dollars that increases Houston’s bonus pool for the upcoming draft from $6.75 million to $8.6 million. While it is difficult to gauge how much a draft pick will ultimately be worth, the emphasis placed by clubs on the draft has dramatically increased over the last decade and losing two high draft picks is definitely the biggest blow to the Cardinals who will now wait until pick 94 to make their first selection in the draft (STL already forfeited their top choice when they signed CF Dexter Fowler earlier this offseason). The loss of these picks is not going to destroy the franchise, but it will significantly impact a team like the Cardinals that prides itself on building through the draft.

At the end of the day, the Cardinals received one of the toughest, if not the toughest, penalty ever handed down by MLB, and they completely deserved it. Not only did it more than adequately compensate Houston for their losses and bring the importance of cyber security to the attention of MLB, it also provided ample deterrence to individuals considering engaging in this type of behavior.

Ultimately, then, the most important thing Manfred needed to accomplish with this punishment was to deter future such behavior. MLB is a multi-billion dollar industry with every participant constantly looking for a competitive advantage. If the Cardinals got off with a mere slap on the wrist, there is no doubt more incidents like this would occur and tarnish the product the league puts out every year.

I strongly believe this type of incident will rarely, if ever, occur in MLB again because of the strong response by Manfred.  If you need more convincing that the parties received adequate punishment, ask Mr. Correa for his thoughts…when he is released from prison.


  1. Ben Reiter, As hacking scandal finally ends, Astros satisifed with Cardinals’ penalty, SI (Jan. 31, 2017).
  2. Bernie Miklasz, Plot thickens in Cards’ hacking scandal, St. Louis Post-Dispatch (Jul. 3, 2015).
  3. Derrick Goold, Former Cardinals scouting director admits illegal access to Astros’ database,
    St. Louis Post-Dispatch (Jan. 9, 2016)
  4. Jesus de Jesus Ortiz, Prison term for hacking further sullies Cardinals’ reputation,
    St. Louis Post-Dispatch
  5. Michael S. Schmidt, Cardinals investigated for hacking into Astros’ database, NY Times (Jun. 16, 2015).
  6. Tom Verducci, Lax hack smack: MLB, Rob Manfred let Cardinals off easy in hacking scandal, SI, (Jan. 30, 2017).