People whose email addresses turn up in dark web monitoring scans are receiving alerts naming a “Disney Internal 37M (Slack)” breach, which traces to the July 2024 leak of Disney’s internal Slack data rather than a new hack. A proposed employee class action over that leak settled and was dismissed in Los Angeles without a public claim process, so there is nothing to claim.
Allegations Only · Case Dismissed
This article describes a class action complaint. The claims in it are unproven allegations. The Walt Disney Company was never found liable, no class was certified, the case was dismissed after a settlement whose terms are not public, and there is nothing to claim. This page is informational and is not legal advice.
What Is the “Disney Internal 37M (Slack)” Alert?
Dark web monitoring services, the kind built into password managers, email providers, credit bureaus and identity-protection apps, scan leaked files for their users’ email addresses and send an alert when they find a match. Alerts with the breach name “Disney Internal 37M (Slack)” and a “date found” of August 31, 2026 are pointing to a copy of the data stolen from Disney’s internal Slack workspace in 2024. The hacker posted that data on a forum on July 12, 2024, under the title “DISNEY INTERNAL SLACK.” The date on the alert is when the monitoring service found the copy, not when anything was taken from Disney, and no new Disney breach has been reported.Free settlement alerts
Get notified when new class actions open to claims
Join thousands of readers who get the latest class action settlements you may qualify for — delivered straight to your inbox.
What Happened in the Disney Slack Leak?
The facts below come from the plea agreement and sentencing papers in United States v. Kramer, No. 2:25-cr-00333 in the U.S. District Court for the Central District of California. In early 2024, Ryan Mitchell Kramer of Santa Clarita, California, posted a program on GitHub and other sites that claimed to generate AI art but was malware. Sometime in April or May 2024, a Disney employee downloaded it. That gave Kramer access to the employee’s personal computer and to an online account where the employee kept passwords for personal and work accounts. Using the employee’s Disney Slack login, Kramer reached thousands of non-public Slack channels and, in May 2024, downloaded about 1.1 terabytes of data, including employee conversations about ongoing work, shared files and non-public information about released and unreleased Disney projects.In July 2024, Kramer contacted the employee by email and Discord while posing as a fake Russia-based hacktivist group called “NullBulge.” A July 8 message demanded the employee’s “cooperation” and warned that if the employee told anyone, the group would “drop our data publicly and loudly.” A July 12 email asked, “You sure that’s how you want to play?” When the employee did not respond, Kramer released the Slack files the same day, along with the employee’s own bank, medical and personal records, on several online platforms. Two days later he wrote again, offering to take the data down, “but not for free.” The employee never answered. Kramer also admitted that at least two other people downloaded the same malware and that he got into their computers and accounts.
Timeline of the Disney Slack Breach
- Early 2024: Malware disguised as an AI art tool is posted on GitHub and other sites.
- April–May 2024: A Disney employee downloads it; about 1.1 terabytes of Slack data is copied in May.
- July 8–14, 2024: Extortion messages to the employee; the data is posted July 12 as “DISNEY INTERNAL SLACK.”
- August 2024: Disney discloses the incident in its quarterly report to investors.
- September 2024: The Wall Street Journal details what was leaked, and Disney says it will move most of its business off Slack.
- October 3, 2024: The Margel class action is filed in Los Angeles; an amended complaint follows October 30.
- May 1, 2025: Federal prosecutors file charges and Kramer’s plea agreement; he pleads guilty June 4, 2025.
- September 19, 2025: A Notice of Settlement is filed in Margel; dismissal papers follow in February 2026.
- May 15, 2026: Kramer is sentenced to 15 months in federal prison.
- July 16, 2026: The court vacates the restitution hearing after the parties agree no restitution will be ordered.
- August 2026: Kramer’s deadline to surrender to begin his sentence; dark web monitoring services log a copy of the data on August 31.
How Was the Hacker Sentenced?
Kramer pleaded guilty to one count of accessing a computer and obtaining information, tied to the intrusion into Disney’s Slack, and one count of threatening to damage a protected computer, tied to the extortion of the employee. The probation office calculated an advisory Sentencing Guidelines range of 37 to 46 months, and prosecutors asked for 27 months. On May 15, 2026, U.S. District Judge André Birotte Jr. sentenced him to 15 months in prison on each count, served at the same time, followed by two years of supervised release and a $200 special assessment. The court waived any fine after finding he could not pay one. Court records show a verification of his surrender to the Bureau of Prisons was filed September 3, 2026.What Did the Breach Cost Disney?
In sealed exhibits described in the government’s sentencing memo, Disney documented the executive, technical and legal teams it pulled in to respond, invoices from outside incident-response firms and lawyers, and the time spent by its own staff. Counting only the four months after the breach, Disney put its loss at a conservative $2,319,780.26. That figure drove the sentencing calculation but did not turn into a repayment order: in July 2026, prosecutors, the defense and Disney agreed that no restitution would be ordered. Their filing cites the Supreme Court’s 2018 decision in Lagos v. United States, which held that federal restitution law does not cover the cost of an investigation a victim company chooses to conduct on its own.What Did Disney Say About the Breach?
In its quarterly report filed in August 2024, Disney told investors it was investigating “the exfiltration and unauthorized release of over a terabyte of data from one of the communication systems used by the Company.” It said it had notified a data protection regulator and might notify other regulators and individuals “regarding impacted employee information,” and that it did not expect the incident to have a material impact on the company. When the Wall Street Journal reported on the contents of the leak in September 2024, a Disney spokesman declined to discuss “unverified information” obtained through a “bad actor’s illegal activity.” That same month, a memo from Chief Financial Officer Hugh Johnston told employees that most of the company’s businesses would stop using Slack.What Information Was in the Leaked Files?
Most of the data was Disney’s own work material: internal messages, unreleased projects, images, code and links to internal tools. Personal information was mixed in. The Wall Street Journal, as summarized in later coverage, reported that the dump contained more than 44 million Slack messages, about 18,800 spreadsheets and 13,000 PDFs, and that some messages included passport numbers, visa details, birthplaces and home addresses of Disney Cruise Line employees. Some spreadsheets reportedly listed names, addresses and phone numbers of Disney Cruise Line passengers.That mix explains why people outside Disney are getting alerts. A Slack workspace holds email threads, vendor lists, guest records and shared files, so an outside email address can appear in the data without the person ever having worked for Disney. Whether an address appeared next to anything more sensitive depends on where it was found, which the alert service’s breach details usually describe.
Where Does the 37M Figure Come From?
Neither Disney nor federal prosecutors has published a 37 million figure. Prosecutors described the theft by size, about 1.1 terabytes, and press reports counted more than 44 million messages. The “37M” in the alert name appears to be the monitoring service’s own count of records in the copy it indexed, and OCA could not match it to any official number. As of October 8, 2026, the public Have I Been Pwned breach database did not list a Disney Slack breach, so the alert most likely comes from a commercial monitoring service with its own dark web sources.Was There a Disney Data Breach Lawsuit?
Yes. Margel v. The Walt Disney Company, No. 24STCV25787, was filed on October 3, 2024, in Los Angeles County Superior Court against The Walt Disney Company and Disney California Adventure. The 32-page complaint seeks to represent people who gave Disney highly sensitive personal information in connection with their employment, a group it estimates in the thousands. It alleges negligence, breach of implied contract and violations of privacy law, and claims that Disney failed to prevent the breach and did not adequately tell affected people what was taken. An amended complaint filed October 30, 2024 narrowed the proposed class to California citizens whose information was exposed and added claims under the California Customer Records Act, the Confidentiality of Medical Information Act and the state’s unfair competition law. The plaintiff asked for damages and for Disney to strengthen its data security. Judge Kenneth R. Freeman presided.These were allegations that no court ruled on, and Disney did not comment to the Los Angeles Times when the suit was filed. According to the court’s docket, a Notice of Settlement was filed on September 19, 2025, dismissal papers followed in February 2026, and the case is now marked disposed. The settlement terms have not been made public. OCA has found no motion for preliminary approval, class notice or settlement website, the steps California courts require before a class-wide settlement can pay class members, which suggests the case ended without a class settlement fund. There is no claim form for employees or anyone else.
What Do Consumer Agencies Say About Breach Alerts?
The Federal Trade Commission’s guidance on data breaches says the right response depends on what kind of information was exposed. For an email address alone, its guidance centers on changing any password that was reused, turning on two-factor authentication, and watching for phishing messages that mention the breach to seem legitimate. For leaked passport or Social Security numbers, the FTC points to IdentityTheft.gov, which lists steps by type of data.Questions
Is “Disney Internal 37M (Slack)” a new Disney data breach?
No new Disney breach has been reported. The name matches the July 2024 leak of Disney’s internal Slack data, which was posted on a hacking forum under the title “DISNEY INTERNAL SLACK.” The “date found” on an alert is when the monitoring service came across a copy of the files, not when the data was taken.
Where does the 37M number come from?
Neither Disney nor federal prosecutors have published a 37 million figure. Prosecutors described about 1.1 terabytes of data from thousands of Slack channels, and press reports counted more than 44 million messages. The 37M label appears to be the monitoring service’s own count of records in the copy it found; OCA could not match it to any official number.
Is there a Disney Slack data breach settlement to claim?
No. A proposed class action, Margel v. The Walt Disney Company, was filed in Los Angeles County Superior Court in October 2024 on behalf of people who gave Disney personal information in connection with their employment. A notice of settlement was filed in September 2025 and the case was dismissed in February 2026, but no class was certified, no settlement terms were made public and no class notice or claim form was issued, so there is nothing to claim.
Who was behind the Disney Slack leak?
Ryan Mitchell Kramer of Santa Clarita, California, who posed as a hacktivist group called NullBulge. He pleaded guilty in federal court in Los Angeles to accessing a computer and obtaining information and to threatening to damage a protected computer. On May 15, 2026, U.S. District Judge André Birotte Jr. sentenced him to 15 months in prison, below the 27 months prosecutors sought, and no restitution was ordered.
Does the alert mean a password was leaked?
Not necessarily. An alert means the monitoring service found the email address somewhere in the leaked files. The Slack data was internal workplace messages and documents, so an outside email address could appear in a message, a spreadsheet or a shared file without any password attached. The alert service’s own breach details list which kinds of data it found.
Did Disney get restitution from the Slack hacker?
No. Disney documented about $2.3 million in response costs, which counted toward the sentence, but in July 2026 the prosecutors, the defense and Disney agreed that no restitution would be ordered, citing a Supreme Court ruling that federal restitution law does not cover a victim company’s own investigation costs.
Did Disney notify people affected by the Slack leak?
Disney’s August 2024 quarterly report said it had notified a data protection regulator and might notify other regulators and individuals about impacted employee information. The Margel lawsuit alleged that Disney did not adequately tell affected people what was taken; that claim was never decided.
Sources
• United States v. Kramer, No. 2:25-cr-00333 (C.D. Cal.) — docket, plea agreement, sentencing memorandum, judgment and restitution stipulation• The Walt Disney Company — Form 10-Q for the quarter ended June 29, 2024 (“Data Compromise”)
• BleepingComputer — Disney ditching Slack after the July breach
• Entrepreneur — summary of the Wall Street Journal’s September 2024 report on the leaked files
• Trellis — Margel v. The Walt Disney Company docket summary
• U.S. Attorney’s Office, Central District of California — plea agreement announcement
• Los Angeles magazine — May 2026 sentencing report
• Patch — sentencing report
• BleepingComputer — guilty plea and the “DISNEY INTERNAL SLACK” forum post
• Los Angeles Times — October 2024 report on the class action
• WDW News Today and Inside the Magic — coverage of the Margel complaint
• Malwarebytes — July 2024 analysis of the leak
• Federal Trade Commission — IdentityTheft.gov
