Exclusive data reveals that children as young as seven are being referred to Britain's national cybercrime intervention programme, as former criminals warn that hacking has become 'mainstream' and often starts with online gaming.
Alarming rise in young cybercrime referrals
The National Crime Agency (NCA) has told Sky News Money that the average age of referrals to its Cyber Choices programme this financial year is just 15, with the youngest being only seven years old. The programme is designed for individuals committing or intending to commit entry-level cybercrime.
The NCA reports a year-on-year increase in referrals, predominantly involving gamers aged between 10 and 16. This trend coincides with a staggering 230% rise in insurance payouts to UK businesses that have been hacked.
"I don't think the referrals represent the full scale of the threat," warns Jonathan Broadbent, a senior officer at the NCA's National Cyber Crime Unit. He highlighted that cybercrime against schools is "really quite prevalent across the country," with students responsible for 57% of insider data breaches in schools between January 2022 and August 2024.
From gaming to federal prison: A well-trodden path
Two reformed hackers, who served prison sentences for stealing millions in cryptocurrency, have spoken exclusively about the dangers. They confirm that gaming is a major pathway into illicit activity, participated in by 97% of children aged eight to 17.
Ricky Handschumacher, 32, from Florida, was introduced to hacking through a video game at age 15. This ultimately led to a four-year federal prison sentence for stealing $7.6m in cryptocurrency. "They are even more vulnerable right now than back then because it's so mainstream," he said, urging parents to pay close attention to their children's online activities.
Joseph Harris, 28, now runs a cybersecurity firm. His journey began at age 12 with the children's game Club Penguin, where he discovered a bug. He progressed to stealing and selling valuable in-game accounts, making thousands of dollars by age 13. "The thrill and the accomplishment was more of a rush for me than the actual money," Harris admitted.
The psychology and community behind teenage hacking
Chartered psychologist Professor John McAlaney notes a suggested link between neurodiversity and hacking proficiency. Approximately 17% of people referred to UK cybercrime investigation groups between 2017 and 2020 had diagnosed autism or self-referred autistic-like traits.
However, McAlaney cautions against stereotypes, emphasising that the social identity and positive reinforcement within online hacking communities can be a powerful draw. "You do get what can be surprisingly quite nice support networks on what may look like a criminal hacking forum," he explained, appealing to a teenager's desire for belonging.
Both Harris and Handschumacher described a loose, fluid network of young hackers rather than highly organised gangs. They also highlighted the 'disinhibition effect' of operating online, where the consequences for victims feel less real.
Redirecting talent towards cybersecurity careers
The surge in young cybercriminals is occurring against a backdrop of a global shortage of cybersecurity professionals. Organisations like The Hacking Games (THG) are trying to redirect teenage hackers towards legitimate careers.
"The issue is the industry is really conventional in how they look at talent," says THG founder Fergus Hay. He argues the sector misses an entire generation developing skills in non-conventional areas like gaming, which fosters puzzle-solving and logical mindsets.
Both reformed hackers argue that financial incentives must be part of the solution. They point to 'bug bounty' programmes, where companies pay for finding security flaws, but say payments are often too low to deter would-be criminals. "You're going to either make a million or a thousand. I guarantee you, 99% of 16-year-olds are going to take the million," said Handschumacher.
The NCA's Cyber Choices programme is undertaking outreach in schools, educating children about computer misuse laws and promoting legal cyber opportunities, in a critical effort to stem the tide of young people entering cybercrime.
