Correa, 35, was charged with five counts of unauthorized access of a protected computer and pleaded guilty to all counts. No other Cardinals employee was charged in the hacking scandal.
The Astros operated a private online database, nicknamed Ground Control, that housed a variety of confidential information, including scouting reports, statistics and contract information. It also housed the email accounts of Astros employees.
As part of a plea deal, Correa admitted that he accessed the database and email accounts of others from March 2013 to March 2014 in order to gain access to Astros' proprietary information.
When an Astros employee who had previously worked for the Cardinals returned his Cardinals-owned laptop to Correa, he also gave him the password, allowing Correa to then access the employee's Astros email account. Throughout 2013, Correa was able to access scout rankings of every player eligible for the draft and viewed a weekly digest page that described the performance and injuries of prospects the Astros were considering, according to officials.
In July 2013, Correa accessed the account during the trade deadline and viewed notes of the Astros’ trade discussions with other teams, the officials said.
After another set of intrusions in March 2014, Astros personnel implemented more security precautions by changing the database's URL and requiring all users to switch to more complex passwords. Correa was able to access the former Cardinals employee's email once again on his old laptop and obtained the new URL and newly reset passwords for all employees, according to the DOJ.
Correa then viewed a total of 118 webpages including rankings of players whom Astros scouts desired in the upcoming draft, summaries of scouting evaluations and summaries of college players identified by the Astros’ analytics department as top performers, according to the DOJ.
Correa joined the Cardinals in 2009 and was made Director of Scouting in December 2014. He was fired in July.
Each conviction of unauthorized access of a protected computer carries a maximum possible sentence of five years in federal prison and a possible $250,000 fine, the Department of Justice said.
Major League Baseball issued a statement Friday following Correa's guilty plea:
“Major League Baseball appreciates the efforts of federal law enforcement authorities in investigating the illegal breach of the Astros’ baseball operations database, and identifying the perpetrator of this crime," the league said. "We anticipate that the authorities will share with us the results of their investigation at the appropriate time, and we will determine what further actions to take after receiving all the relevant information.”
A representative for the St. Louis Cardinals was not immediately available. A representative for the Houston Astros declined to comment.