On Christmas morning 2014, millions of people unwrapped new PlayStations and Xboxes that could not get online, because a crew of teenagers with a rented flood of traffic had decided the funniest possible day to break the world's two biggest gaming networks was the day the most people would be using them. Four months earlier the same crew had tweeted a bomb threat at American Airlines and grounded a plane carrying a Sony executive. They gave TV interviews about it, sold the attack tool as a subscription service, got that service hacked, and then got arrested in three countries. If LulzSec was fifty days of lulz with a manifesto, Lizard Squad was the sequel with the manifesto removed and a merch table installed.
Lizard Squad — a DDoS-for-attention crew, active ~August 2014–2015, membership fluid and mostly teenage FACT
SCENE
The gamer-era heirs of the LulzSec "for the laughs" template — maximum trolling, minimum cause — in the booter-crew rivalry culture of the mid-2010s (see Crew Rivalries and TeaMp0isoN for the generation before)
THE DRAMA
The Christmas 2014 takedown of PlayStation Network and Xbox Live; the bomb-threat tweet that diverted AA Flight 362 carrying Sony Online Entertainment president John Smedley; the LizardStresser attack-for-hire service — which was itself breached, exposing its paying customers
RECORD
Julius "zeekill" Kivimäki convicted in Finland, July 2015, on 50,700 counts of computer crime — two-year suspended sentence, offenses committed as a juvenile. U.S. federal charges against two others (2016). One UK arrestee, Vinnie Omari, was later cleared FACT
STATUS
SCATTERED — dissolved into arrests, copycat crews, and, for its best-known member, a far darker second act
This file is not an accusation; the accusations were made by prosecutors on two continents, and the central ones stuck. It is a record of what the LulzSec formula looked like one generation on, run by kids who grew up watching the Lulz Boat: the same theatrical breach-as-performance, the same TV interviews, the same smug register — but pointed at gaming networks instead of governments, monetized as a rental service instead of dumped as a manifesto, and escalated, once, into a bomb threat against a passenger aircraft. The through-line is the gap between the self-image (merry pranksters exposing bad security) and the paperwork (a diverted plane, millions of locked-out users, a customer database of people paying to attack each other, and a court docket).
the drama timeline
ACT I — SUMMER OF THE LIZARD (AUG 2014)
A new name appears on Twitter, floods Sony's network offline, and — in the same news cycle — discovers the fastest way to turn a prank into a federal case.
AUG 2014
The flood
Lizard Squad surfaces in August 2014 and announces itself the way its whole era would: distributed denial-of-service. On August 24 it knocks Sony's PlayStation Network offline with a traffic flood, along with other gaming services, and claims the credit loudly on Twitter. No breach, no data — just outage as spectacle, the LulzSec instinct with the politics drained out.
The same day, Sony Online Entertainment president John Smedley tweets that he's flying Dallas to San Diego. Lizard Squad tweets at American Airlines that his plane — Flight 362 — has "explosives on board. Please look into this." The airline diverts the flight to Phoenix; the FBI meets it on the tarmac and searches it for hours with 179 passengers and 6 crew aboard. Nothing is found, because there was nothing — it was a tweet. A DDoS crew has just grounded a commercial airliner with 140 characters, and the investigation is now a federal one.
Christmas Day, the two biggest gaming networks on earth, and a crew that picked the date specifically because it would hurt the most people. Then a file-sharing tycoon buys them off with cloud-storage vouchers, and one of them explains himself on television.
DEC 25, 2014
Christmas offline
Lizard Squad floods PlayStation Network (~110 million subscribers) and Xbox Live (~48 million) off the internet on Christmas Day — the one morning of the year when millions of brand-new consoles are coming online for the first time. Xbox Live claws back within about a day; PSN outages drag on roughly 48 hours. Members tell the press the date was chosen because it would anger the largest number of people. Brian Krebs files it under a one-word taxonomy: "Cowards."
The attacks stop not because of any firewall but because Kim Dotcom — wanting to play Xbox on Christmas — offers the crew 3,000 lifetime premium vouchers for his Mega storage service, worth $99 apiece, on condition they knock it off. They take the deal and thank him on Twitter. The world's most disruptive outage of the season is resolved by a man under U.S. indictment bribing teenagers with cloud storage. Everyone involved considers this a win.
Two days after Christmas, a member calling himself "Ryan" gives Sky News an on-camera interview from Finland, expressing no remorse and framing the takedown as a security lesson for two corporations and a favor to children who should have been spending the holiday with their families. Court reporting on the later Finnish conviction, and KrebsOnSecurity at the time, identified the crew's on-air spokesman as Julius "zeekill" Kivimäki. Where LulzSec spoke through communiqués, its heirs booked television.
Sky News, December 27, 2014: "Lizard Squad Member: Why I Took Down Xbox and PlayStation." The crew's spokesman, on the record, mid-spree — the primary source for the register this file documents.
ACT III — THE MERCH TABLE, AND THE KNOCKS (DEC 30, 2014–JAN 2015)
The Christmas attack turns out to have been an advertisement. The product ships within the week — and then the product gets hacked, the arrests start, and the crew defaces an airline for a laugh at the dead.
DEC 30, 2014
LizardStresser: the outage, as a service
The crew launches LizardStresser, a paid attack-for-hire "booter" — the Christmas takedown repackaged as a subscription product. KrebsOnSecurity establishes that the firepower behind it comes largely from hacked home routers: ordinary people's equipment, conscripted to sell outages to other people. The "awareness" campaign now has a price list, which clarifies the motive question considerably.
UK police arrest Vinnie Omari, 22, in Twickenham — a self-identified Lizard Squad associate who had been giving press and TV interviews about the crew — on suspicion of fraud and Computer Misuse Act offenses in a PayPal-theft investigation. He hands the search warrant to reporters himself. He is bailed, and later cleared of any involvement — which makes him the rare figure in this file whose loudest act was talking about it.
UK officers arrest an 18-year-old in Southport in connection with the Christmas attacks and with "swatting" incidents — hoax emergency calls sending armed police to victims' homes, the same escalation logic as Flight 362 pointed at private addresses. The investigation is now jointly worked by UK crime agencies and the FBI.
LizardStresser is itself breached, and its customer database — more than 14,000 registered users, usernames and passwords stored in plaintext, over $11,000 in bitcoin deposits — leaks to researchers and, in due course, law enforcement. The crew that built its brand mocking Sony's security had shipped a product with none, and its paying customers were now a conveniently formatted suspect list. In the booter-crew scene, hacking the rival's stresser was the era's signature dunk; this one was self-inflicted at the infrastructure level.
Visitors to Malaysia Airlines' website — an airline that had lost two aircraft and 537 people the previous year — are redirected to a page showing a lizard in a top hat and the headline "404 - Plane Not Found." The airline says its DNS was hijacked, not its systems breached. It is the crew's purest artifact: maximum cruelty, zero cause, engineered entirely for screenshots.
The courts work through the roster. The scene's answer to "what happens to a for-the-lulz kid" comes back in three very different sizes.
JUL 2015
50,700 counts, zero days served
A court in Espoo, Finland convicts Julius "zeekill" Kivimäki, 17, of 50,700 counts of aggravated computer break-in and related offenses — a spree spanning intrusions, hijacked email, and swatting. Because the offenses were committed as a juvenile, the sentence is a two-year suspended term: no prison. Security commentators, Krebs loudest among them, warn on the record that walking a prolific 17-year-old on 50,700 counts is a lesson — just not the intended one.
U.S. federal prosecutors in Chicago announce charges against Zachary Buchta (Maryland, 19) and Bradley Jan Willem van Rooy (Netherlands, 19), alleging they operated Lizard Squad and successor attack-for-hire and harassment services. The charges are the DOJ's; they close the arc from Christmas prank to federal cybercrime-conspiracy paperwork.
The suspended sentence was not the end of the story. In April 2024, a Finnish court convicted Kivimäki — by then using the name Aleksanteri — in the unrelated Vastaamo psychotherapy-clinic breach and extortion case, sentencing him to six years and three months in prison. That case belongs to its own, much grimmer file; it is noted here only as the court record's answer to where the story went.
The case: strip the branding and Lizard Squad was rented traffic pointed at soft targets, plus a bomb threat. The Christmas victims were not Sony and Microsoft; they were tens of millions of ordinary users, many of them children, locked out of what they'd unwrapped that morning. Flight 362 put 185 people on a Phoenix tarmac for a hoax. LizardStresser monetized the whole act — running on hijacked home routers — and the Malaysia Airlines defacement mocked 537 dead people for engagement. Courts in Finland and prosecutors in the U.S. treated the conduct as crime because it was.
Not even the skill defense applies: LulzSec's defenders could at least point to real intrusions exposing real negligence. DDoS is volume, not craft — the scene's own long-standing verdict on booter crews — and the crew's flagship product stored its customers' passwords in plaintext.
The defense, such as it was: in their own interviews the members claimed a security rationale — that two of the richest companies on earth ran consumer networks a handful of teenagers could knock over, and that proving it on the loudest possible day was the only demonstration anyone would notice. The point, however delivered, was true: PSN and Xbox Live fell to commodity attacks, twice, months apart.
They were children, and the courts said so: the Finnish court found Kivimäki's 50,700 offenses were committed as a juvenile and sentenced accordingly; other arrestees were teenagers; one publicly-arrested associate, Vinnie Omari, was cleared entirely. The juvenile-justice logic — that a 17-year-old is not finished — is a real principle, applied as designed.
YOU DECIDE
LulzSec at least pretended to a cause and eventually acquired one; its gamer-era heirs kept the smirk and dropped everything else. What's left on the record is a crew that proved two genuinely embarrassing things — that the world's biggest entertainment networks couldn't withstand teenagers, and that a tweet could ground an airliner — and proved them in the cruelest available ways, then tried to sell you the tool. Whether that's the scene's id with the mask fully off, or just what happens when the "for the laughs" template reaches kids with nothing to say, is yours to weigh. The archive notes only that the era's loudest lesson about juvenile leniency got its answer in a Finnish courtroom nine years later.
The archive does not deify. It keeps the Christmas outage map — and the plaintext customer list.
evidence locker
PRIMARY / REFERENCE
Wikipedia — Lizard SquadATTRIBUTED — dated timeline: the August 2014 emergence, the Aug 24 PSN attack and Flight 362 diversion, the Christmas takedown and durations, the Dotcom vouchers, the Sky News interview, the arrests, and Omari's later clearing.
en.wikipedia.org/wiki/Lizard_Squad
BBC News — "Finnish teen convicted of more than 50,000 computer hacks"FACT — the July 2015 Espoo court conviction of Julius Kivimäki: 50,700 counts, two-year suspended sentence, juvenile finding.
bbc.com/news/technology-33442419
CONTEMPORANEOUS REPORTING
BBC News — "Xbox and PlayStation resuming service after attack"ATTRIBUTED — the Christmas outage and restoration, and the first-party "because we can" line from "Member Two" on BBC Radio 5live.
bbc.com/news/uk-30602609
Forbes — "Hackers Ground Sony Executive's Flight With Bomb-Threat Tweet"ATTRIBUTED — Aug 24, 2014: the Smedley flight diversion and the same-day PSN attack.
forbes.com/sites/insertcoin/2014/08/24/
CBS DFW — "Bomb Threat Tweets Cause AA Plane To Be Diverted"ATTRIBUTED — the tweet text as broadcast, the Phoenix diversion, the four-hour FBI search, the passenger count.
cbsnews.com/texas — bomb-threat tweets
UPI — "American Airlines flight diverted after hackers make bomb threat"ATTRIBUTED — the FBI's statement on Flight 362.
upi.com — Aug 25, 2014
The Register — the Kim Dotcom voucher dealATTRIBUTED — Dec 26, 2014: 3,000 Mega vouchers in exchange for stopping the attacks.
theregister.com — Dec 26, 2014
Sky News (official channel) — "Lizard Squad Member: Why I Took Down Xbox and PlayStation"FACT — the December 27, 2014 on-camera interview, first-party primary source, embedded above.
youtube.com/watch?v=fPX8yCBdIZ8
The Register — Southport arrest / Kivimäki walks freeATTRIBUTED — the Jan 16, 2015 UK arrest, and the July 2015 sentencing analysis.
theregister.com/2015/07/08/
NBC News / BBC — Malaysia Airlines defacementATTRIBUTED — Jan 26, 2015: "404 - Plane Not Found" and the airline's DNS-compromise statement.
nbcnews.com — Malaysia Airlines
troll.fan — LulzSecCROSS-LINK — the direct ancestor: the "for the laughs" template Lizard Squad inherited and stripped for parts.
troll.fan/dossiers/lulzsec.html
troll.fan — SabuCROSS-LINK — how the previous "for the lulz" crew actually ended; the cautionary tale this one didn't read.
troll.fan/dossiers/sabu.html
troll.fan — Crew RivalriesCROSS-LINK — the beef-and-shoutout economy this crew was built for.
troll.fan/crew-rivalries.html
troll.fan — TimelineCROSS-LINK — Lizard Squad's 2014-15 run in the scene's wider chronology.
troll.fan/timeline.html
The standard. Lizard Squad is a documented, largely adjudicated public matter: the Christmas takedown, the Flight 362 diversion, the LizardStresser service and its breach, and the prosecutions are stated as fact per contemporaneous reporting, an FBI statement, a DOJ press release, and Finnish court records. Named individuals appear only where publicly convicted, publicly charged, or self-identified on the record — and where an arrestee was cleared (Vinnie Omari), that clearing is stated at full strength. Several participants were juveniles; the courts' juvenile findings are reported as the courts made them. The Vastaamo conviction is noted in one attributed line as epilogue, without importing that case's detail. Members' "awareness" rationale is given in their own words, attributed, not adopted. This page documents a record; it describes no methods. If a line here couldn't survive scrutiny, it wouldn't be on the page.