USA V. THOMPSON, No. 22-30179 (9th Cir. 2025)
Annotate this Case
Paige Thompson committed a significant data breach, hacking into Amazon Web Services (AWS) customers' accounts, stealing data from at least 30 entities, and causing tens of millions of dollars in damage. She also used the stolen credentials to mine cryptocurrency, further increasing the financial impact on the victims. Thompson was arrested after she revealed her activities to a cybersecurity professional, leading to an FBI investigation.
The United States District Court for the Western District of Washington calculated Thompson's sentencing range under the Federal Sentencing Guidelines to be 168 to 210 months of imprisonment. However, the court granted a substantial downward variance, sentencing her to time served (approximately 100 days) and five years of probation. The court emphasized Thompson's personal history, including her transgender identity, autism, and past trauma, as significant factors in its decision.
The United States Court of Appeals for the Ninth Circuit reviewed the case and found that the district court overemphasized Thompson's personal story and failed to properly weigh several of the 18 U.S.C. § 3553(a) factors. The appellate court held that the district court's findings regarding Thompson's lack of malicious intent, her remorse, and the seriousness of her actions were clearly erroneous and not supported by the record. The Ninth Circuit also noted that the district court did not adequately consider the need for general and specific deterrence or the risk of unwarranted sentencing disparities.
The Ninth Circuit vacated Thompson's sentence and remanded the case for resentencing, instructing the district court to properly weigh all relevant factors and provide a more substantial justification for any variance from the Guidelines.
Sign up for free summaries delivered directly to your inbox. Learn More › You already receive new opinion summaries from Ninth Circuit U.S. Court of Appeals. Did you know we offer summary newsletters for even more practice areas and jurisdictions? Explore them here.
Court Description: Criminal Law. The panel vacated Paige Thompson’s sentence and remanded for resentencing in a case in which Thompson committed the second largest data breach in the United States at the time, causing tens of millions of dollars in damage and emotional and reputational harm to numerous individuals and entities.
The district court correctly calculated Thompson’s sentencing range under the Federal Sentencing Guidelines to be 168 to 210 months of imprisonment. It then granted a roughly 98% downward variance to time served (approximately 100 days) and five years of probation.
The panel held that the district court overemphasized Thompson’s personal story and committed a clear error of judgment in weighing several of the factors set forth in 18 U.S.C. § 3553(a), which resulted in a substantively unreasonable sentence.
The panel held that it was clear error for the district court to conclude that Thompson’s actions were not “malicious,” that Thompson did not do anything “bad” before she was caught, and that Thompson was “tortured and tormented about what she did,” given that these findings were not supported by the record.
Noting that the district court considered that Thompson is transgender and autistic, and has suffered prior trauma in her life, the panel explained that Thompson’s personal background and characteristics are proper considerations at sentencing, but they may not be the sole basis for the chosen sentence.
The panel explained that fraud crimes typically are calculated and, as a result, are particularly amenable to general deterrence. The district court’s failure to give this factor meaningful weight was a clear error of judgment. As for specific deterrence, the district court’s failure to consider highly relevant evidence of Thompson’ risk of recidivism was an abuse of discretion.
Beyond the district court’s general acknowledgment that the Guidelines help avoid sentencing disparities, nothing in the record indicates that the district court weighed the risk of unwarranted disparity in choosing the sentence. Given the district court’s unsupported findings on some of the relevant facts, the panel concluded that the district court’s explanation for the sentence it imposed is inadequate to justify the resulting disparity between Thompson’s sentence and the sentences imposed in other cases, which is a weighty consideration given the extent of the district court’s variance.
Dissenting, Judge Sung concluded that the sentence is substantively reasonable under an abuse of discretion standard. She wrote that while the majority clearly disagrees with the district judge’s conclusion that consideration of the § 3553(a) factors justified a sentence of probation and believes that the circumstances presented here were insufficient to sustain such a marked deviation from the Guidelines range, it is not for the Court of Appeals to decide de novo whether the justification for a variance is sufficient or the sentence reasonable.
Some case metadata and case summaries were written with the help of AI, which can produce inaccuracies. You should read the full case before relying on it for legal research purposes.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.