Cyber Threat Actor: Ryan S. Hernandez

Ryan S. Hernandez, also known by the aliases Ryan West and RyanRocks, is a cyber threat actor who operated from California in the United States. He began his illicit activities while still a minor and was later identified as working with an associate during the initial compromise of Nintendo’s systems. His online moniker and real name were used interchangeably across social platforms and forums where he discussed his actions. Hernandez’s activities came to the attention of law enforcement after repeated intrusions and the distribution of stolen proprietary information.

He primarily targeted the video game and console sector, focusing on the Japanese company Nintendo despite being based in the United States. The initial access to Nintendo’s environment was achieved through a phishing campaign that stole employee credentials, which were then used to download confidential files. Hernandez subsequently employed circumvention devices to access pirated games and shared the stolen data via Twitter, Discord, and a self‑created forum called “Ryan’s Underground Hangout,” where he also discussed potential network vulnerabilities. No specific malware families are referenced in the available sources, and his tooling style centered on credential theft, direct file exfiltration, and the use of social media for distribution.

The most notable campaign attributed to Hernandez involved the 2016 phishing‑based breach that led to the leak of pre‑release details about the Nintendo Switch console and other confidential game and developer information. Despite an FBI warning in 2017, he continued to intrude on Nintendo servers from June 2018 through June 2019, repeatedly extracting proprietary data and boasting about his exploits online. A June 2019 search of his residence uncovered thousands of Nintendo files, pirated software tools, and a folder labeled “Bad Stuff” containing over 1,000 images and videos of child sexual abuse material. Hernandez pleaded guilty in January 2020 to computer fraud and abuse and possession of child pornography, agreeing to pay $259,323 in restitution to Nintendo, and was sentenced in December 2020 to three years in prison followed by seven years of supervised release, with mandatory sex offender registration.