I believe he got almost exactly what I got: six months "imprisonment" (served as home detention), five years probation, restitution ($9,000-ish for him), 100 hours of community service, and a few assorted court and administrative fees. Probably also had to pay fees for an ankle monitor system while on home detention, but not sure.

Unless it's changed, I think under the normal federal sentencing guidelines, that amount of "damage" doesn't even qualify for any prison time at all, but the specific offense overrides that to impose a minimum of six months. That's because of a little outcry in the 1990s over hackers not serving any time and the (maybe valid) perception that they actually benefited from the notoriety of a conviction.