This ‘violently racist' hacker claims to be the source of the New York Times' Mamdani scoop

The Verge

5 days ago

The ultimate source for The New York Times' story about Zohran Mamdani's college application is an open secret. It's an anime-loving neo-Nazi whose hobbies include furry drawings, posting fan art of a video game character, and hacking universities. On X, the alleged hacker is followed by New York Times freelancer Benjamin Ryan, who was the first byline on the Mamdani story.
The alleged hacker uses an online handle that is a racial slur, so I will be referring to them as the Anime Nazi; they have taken credit for five hacks of universities. Three of them, as first reported by Bloomberg, targeted the University of Minnesota, New York University, and Columbia University.
Social media reviewed by The Verge — including X and fediverse accounts — shows a series of reposts of statements and images such as swastikas, 'miss u hitler,' and 'minorities have no place in our world.' The Anime Nazi themselves posted such things as 'I am racist,' 'I am violently racist toward black people,' and a picture of a unicorn sitting on a swastika.
On a post from November 5th, 2024, when then-presidential candidate Kamala Harris' X account was encouraging people to vote, the alleged hacker's account replied, 'You will be executed.' The next post after that was 'kill them all please, mr president.' When another X account asked the Anime Nazi if they were concerned about law enforcement, they replied with a quote of a post from President Donald Trump: 'He who saves his Country does not violate any Law.'
The Anime Nazi appears to have been specifically targeting universities, often for admissions data. They claim to have stolen data from millions of people. The data include Social Security numbers, addresses, family members' information, and citizenship status. Perhaps significantly, that information also includes self-reported race — meaning that someone who is, in their own words, 'violently racist toward black people' has lists of people who identify as Black.
The alleged hacker, in response to a request for comment, wrote that this story wouldn't achieve anything but making The Verge look ridiculous and 'giving funny publicity to me.' Most journalists, they claimed, 'are smart enough to figure that out before publishing, so end up removing my name and any direct references to me.' They added, in a separate email, 'My comment: her name is [slur].'
In what little reporting exists about the actual Columbia breach (and not what stolen data reveal about a mayoral candidate when he was 17 years old), the hacker has been said to be 'politically motivated.' Bloomberg, which spoke to the hacker, reported that they are acquiring information about whether universities persisted in affirmative action admissions after the Supreme Court effectively banned the practice in 2023. Insofar as open racism can be said to be a political motivation, the hacker is indeed politically motivated. But it also has the effect of soft-pedaling the reason for repeated attacks on institutions of higher learning. The Anime Nazi is an activist like a Klansman is an activist.
This is important because journalistic best practices around the use of hacked materials is to contextualize the hacker's motivation, if the materials are used at all. While it appears to be true that the hacker opposes affirmative action, it may be more relevant — particularly when the news article in question attacks a left-wing politician of color — that the hacker's pseudonym is literally a racist slur.
The redactions in the New York University data were imperfect, however
The hacker says they redact SSNs and other personally identifying data before releasing information from the intrusions. In the case of the Minnesota hack, they claim, 'I only posted (redacted) bare minimum to prove they're breaking the law.' One of their admirers has claimed they are 'the nicest possible hacker.' The redactions in the New York University data were imperfect, however, says Zack Ganot, the co-founder of Atlas Privacy. 'He says he's not trying to leak personal information,' Ganot says. 'He did a lousy job.' Emails, names, and home addresses, among other personal identifying information, are available in the data from the NYU leak.
Ganot notes that the data is valuable; to his knowledge, the hacker hasn't yet sold it. This isn't necessarily surprising — that's not the kind of damage they're trying to do — but it also doesn't mean the data is safe.
This alleged hacker's racial animus aligns with the recent Republican war on higher education. It also aligns with a turn from certain Silicon Valley circles against elite universities. Universities aren't just politically endangered — they are, in the hacker's own words, 'soft targets.'
'Universities have basically the most vulnerable networks that exist in my experience,' the Anime Nazi wrote. 'Massive networks with huge surface area and a lot of legacy systems.' They also generally spend less on security than private companies. Unless the hacker is caught or America's universities seriously upgrade their security quickly, the Anime Nazi could very well strike again.
So who are they?
By far the majority of the Anime Nazi's posts are of Sachiko Koshimizu, a character from a videogame called The Idolmaster Cinderella Girls. This character also appeared on the front page of 4chan — which adopted the nickname slur years ago — starting as early as 2017. The posts are largely fan art and highly repetitive, almost compulsive or bot-like; the same images are posted repeatedly. The Anime Nazi also likes to respond to other people's posts of Sachiko, saying, 'her name is [slur].'
In older posts, they say they submitted bug reports to various entities under their slur pseudonym, including the University of York and the BBC, in the hopes of having it permanently included on the website. Sometimes their followers will co-opt a phrase used by activists to raise awareness for Black women who are victims of police violence: 'Say her name.' They do not mean Sachiko.
The Anime Nazi's posts tend to appear during waking hours in Japan and Australia, according to an analysis by The Verge — though terminally online posters can (and often do) keep odd hours. When The Verge reached out for comment at 10PM in Japan, the Anime Nazi responded almost immediately, and continued to respond promptly after 1AM JST. However, the timestamps in their emails appeared to indicate that their computer is set to Greenwich Mean Time (the same time zone as London).
One of the places they post is on a notoriously racist Mastodon instance called Poast, which gives us a few further clues — because the instance, where they allegedly served as a moderator for the 'overnight' shift, was apparently hacked in 2023 and had its users' direct messages seemingly leaked.
The Anime Nazi's current X account isn't their first — an early post on their current account has a Twitter-era reply asking what happened to the other one. The Anime Nazi says they will DM on Mastodon. According to the allegedly leaked Poast DMs, the original account was deactivated by Twitter's moderators — the hacker appealed and lost. There is one interaction left over from the previous account, in which a furry called Argyle Achilles thanks the Anime Nazi for fan art of his character. Argyle Achilles is somewhat infamous in the furry community for a video he made titled 'Why We Need Racism.' The Poast leak also appears to contain DMs in which users often request that the hacker make them art.
Most legal and government references in the hacker's posts appear to be to the US government, such as the National Security Agency and the US Cyber Command. The user appears to use American English, preferring '-ize' and 'color' to '-ise' and 'colour.'
Though the Anime Nazi is brazen, they don't leave obvious clues to their identity. The posts on their accounts fall roughly into four categories: bragging about their alleged hacks, posts of Sachiko fan art, vicious racism, and commentary on hacking and code. 'I do 'computer security' for a living,' the Anime Nazi wrote in an October 2023 post. In April, the Anime Nazi noted that just after the NYU hack, police found 'one redirector I logged into something from' and 'physically shut down the device. within a few hours.'
'That response time's actually impressive,' they went on. 'It's not for lack of trying.'
The posts about hacking are the most substantive. At one point, the Anime Nazi celebrates being followed by Harold T. Martin, an NSA contractor who stole government secrets for 20 years, accumulating at least 50 terabytes of data that was mostly 'highly classified and related to hacking,' according to The Washington Post. In another post, the Anime Nazi wrote, 'I see aspiring hacker in your bio friend,' before offering to help that poster learn to code. In 2023, they replied to cybersecurity reporter Kim Zetter, taking issue with a Kaspersky analysis of a spy platform: 'Kaspersky pushing a 'similarities to NSA' angle really hard for some reason, even though it's obviously not.'
There are also a significant number of posts bragging about the Anime Nazi's alleged hacks. 'I'm on TV,' they posted at one point, linking a YouTube video about the University of Minnesota's data breach. They have posted legal complaints filed against New York University by people whose data they allegedly stole. They have also reposted someone with the handle Crémieux calling them the 'nicest possible hacker.' That seems arguable.
On both the Mastodon and X accounts, the hacker takes credit for the three known university hacks — and two that have been, until now, unreported by the media. One, at the University of Mississippi, had to have been placed by someone or something with administrative privileges, according to Palo Alto Networks' writeup of the hack. When the computer was rebooted, it played 'Dixie' through the computer speakers and displayed, the Anime Nazi claimed, a full-screen image of a Confederate flag. The hacker also posted what appears to be a screen recording of the exploit in action. The malware sample in question was flagged by Kaspersky in 2024. The University of Mississippi did not respond to multiple requests for comment.
The target of the alleged hack at Miami University of Ohio is less clear; the hacker posted a screenshot they claimed showed they were inside the university's systems 'a couple years ago.' Miami University did not respond to a request for comment.
Both the NYU and Minnesota hacks spawned lawsuits, though the Minnesota suit was dismissed without prejudice in 2023. According to the complaint, the University of Minnesota was hacked in 2021 and didn't notice until the Anime Nazi posted about it in July 2023. This hacking took place before the Supreme Court ruling outlawed affirmative action — and the data from the hack consequently cannot demonstrate the University of Minnesota was violating the law, due to the linear nature of time. This does somewhat undermine any remaining claims to 'hactivism.'
At NYU, the Anime Nazi hacked the university's actual website over spring break. For about two hours, NYU's homepage displayed links to stolen data, as well as charts that allegedly categorized test scores on the SAT and ACT by race. At least 10 class action lawsuits have been filed as a result. The US has expansive and notoriously punitive anti-hacking laws — and these hacks are big boy crimes. The FBI declined to comment on this story.
During the Columbia hack, Trump's face appeared on some computer screens across campus
During the Columbia hack, Trump's face appeared on some computer screens across campus. That's notable, because Columbia has been in the crosshairs of the Trump administration, which has frozen $400 million of funding while accusing the university of failing to protect Jewish students during protests against the Israeli war in Gaza. The government has targeted Columbia student protesters; one was snatched by ICE and imprisoned in a detention facility, others have had their visas revoked. (Meanwhile, the university has suspended, expelled, and revoked degrees from student protesters).
It's not just Columbia; elite universities have been targeted by the right broadly. Harvard's student data has been subpoenaed, and its accreditation threatened by the Trump administration; right-wing activists had previously forced the resignation of president Claudine Gay, who had been the first Black president of Harvard. University of Virginia president James E. Ryan was forced out in June, after a battle with the Trump administration over the university's diversity, equity and inclusion initiatives. At Johns Hopkins University, Stephen Miller's America First organization lodged a complaint claiming that making the medical school free for students whose families make less than $300,000 amounts to 'mask[ing] racial preferences behind income thresholds.'
The Republican offensive against and 'wokeness' and 'DEI' (diversity, equity, and inclusion programs) is part of a general movement to undo the Civil Right Act. It's an extension of the Republican campaign against affirmative action, admissions policies meant to improve representation among groups that had previously been discriminated against. The Johns Hopkins suit widens the scope beyond taking down efforts towards racial equality, but is ultimately a much more honest expression of what the anti-affirmative action movement is about: to retrench universities as the gated playgrounds of the rich.
Trump advisor and billionaire Marc Andreessen sent messages to a group chat in May saying, 'The combination of DEI and immigration is politically lethal,' according to The Washington Post. 'When these two forms of discrimination combine, as they have for the last 60 years and on hyperdrive for the last decade, they systematically cut most of the children of the Trump voter base out of any realistic prospect of access to higher education and corporate America.'
Andreessen also said that 'my people are furious and are not going to take it anymore' and that 'universities were ground zero of the counterattack.' The universities, he claimed, are 'BOTH actively discriminating against us AND primary origin points and propagation vectors' for diversity policies he says are discrimination.
College admissions officers frequently have institutional priorities beyond test scores and GPA, according to US News and World Report, which maintains a list of the most-prestigious universities in the US. That may include recruiting athletes, musicians, or artists who may not otherwise meet admission requirements; it may also include legacy admissions, or maintaining a mix of in-state and out-of-state students.
In university admissions, one group is consistently discriminated against: women. For more than 20 years, admissions officers have put 'a thumb on the scale to get boys,' as The New York Times puts it. There, the institutional goal is to maintain a desirable gender balance. Discrimination in favor of men does not appear to be something that interests either Andreessen or the Anime Nazi.
The focus on elite universities obscures something else. Many schools have more relaxed admissions policies, and some admit every student who applies. This is to say nothing of community colleges and trade schools. If Americans want 'access to higher education,' they're not short of options — at least, if they have the money for it.
But elite universities are places where power concentrates, which may be why the right wing is so interested in who gets to attend. People who attend those schools often have the connections to take prestigious jobs, especially political office. Which makes the pivot from admissions data broadly to the admissions files of specific individuals — like Zohran Mamdani — a new, more dangerous turn from the hacker. How many other future politicians are in that data? And how disruptive might it be to leak, say, their admissions essays?
The New York Times, which published the story about Mamdani's Columbia application, made no mention of the Anime Nazi in its report. The Mamdani data is credited to 'Crémieux,' a publicly known pseudonym for Jordan Lasker, a prominent internet eugenicist. As noted above, Lasker, under this pseudonym, has called the Anime Nazi 'the nicest possible hacker.' Lasker is among the Anime Nazi's followers and has openly thanked the hacker for their work, saying of the NYU hack in March, 'I hope you manage to do this to more universities.' Lasker wrote about the Columbia hack on June 24th and was, according to The New York Times, the intermediary by which the paper received Mamdani's hacked Columbia application. Reporting from Mother Jones suggests Lasker may have a neo-Nazi history of his own.
Benjamin Ryan, the first byline on the Times' story about Mamdani, follows the alleged hacker on X. Ryan is the only non-staffer on the story and also the only non-political reporter. He typically writes about science for the Times, and often about trans kids in his newsletter. Ryan is a subscriber of Lasker's email newsletter, Cremieux Recueil, according to the 'reads' section of the Substack app. It is not terribly difficult to figure out why Ryan is credited on the story — he is the reporter most likely to have gotten ahold of the application. Ryan did not respond to a request for comment.
Benjamin Ryan, the first byline on The Times' story about Mamdani, follows the alleged hacker on X
It's not unusual for journalists to use hacked materials, or those from less-than-savory sources. But best practices around hacked materials means being judicious about what to use, and giving the audience context about what the hack was meant to accomplish. It is difficult to believe The New York Times doesn't know that — after all, a great deal of discussion around the ethics of using data from hacks sprang from the paper's coverage of leaked emails from a hack of Hillary Clinton's private server. In its story about Mamdani, The Times says the hack 'appears to have been carried out in order to see if Columbia was still using race-conscious affirmative action in its admission policies after the Supreme Court effectively barred the practice in 2023,' but that's it.
The Times account makes no reference to the Anime Nazi. It does not even identify Lasker by name, nor does it note that his pseudonym is a reference to a politician who excluded Muslims from French citizenship. (Mamdani is Muslim.) Mamdani is one of Trump's new obsessions; the president has threatened to arrest the mayoral candidate, falsely suggested Mamdani is in the US illegally, and suggested that if Mamdani is elected, New York City's federal funding might be at risk.
The alleged hacker took credit for the story. 'This wasn't some targeted thing based on 'beef' in the first place,' the Anime Nazi posted on July 7th. 'It was basically an accident.' After noticing Mamdani's application, the Anime Nazi told a chat about it 'because it was funny and it all spiraled from there.'
The Anime Nazi also reposted someone saying, 'I don't really care what Mamdani put on his college admissions, the idea that a guy on Poast could prank Columbia and get The New York Times newsroom to start eating itself alive is hilarious to me.'
The New York Times declined to comment on whether the paper knew there was a social media account taking credit for the hack, whether the ultimate source of the reporting was the Anime Nazi, the comments made by the Anime Nazi's social media accounts, whether Ryan was the source of the scoop, or whether Ryan informed the paper of Lasker's identity beyond the pseudonym. Instead, spokesperson Charlie Stadtlander provided a July 4 X thread from Patrick Healy, the assistant managing editor for standards and trust at the paper, and previous reporting from Lachlan Cartwright's Breaker Media. An email address associated with Lasker did not return a request for comment.
The source of the leaked application was obvious to the Anime Nazi's followers
The source of the leaked application was obvious to the Anime Nazi's followers. Curtis Yarvin, personal friend of Vice President JD Vance and neo-monarchist, commented on a screenshot of a Chris Hayes post from Bluesky, saying, 'He's upset they're not crediting [Anime Nazi].' Another person — a pseudonymous but influential account followed by Elon Musk, Yarvin, Lasker, and others — seemed to believe The New York Times knew about the Anime Nazi, posting, 'It's incredible opsec to have a hacker name so offensive that news media can't even refer to you by your pseudonym and they have to go through your designated 'intermediary' instead.'
If all these crimes are indeed attributable to the Anime Nazi, the Columbia hack and Mamdani leak represent significant escalation. The Columbia hack happened as the school was under political pressure; the Mamdani leak occurred as Trump made him an administration adversary. The alleged hacker quotes Trump publicly as a way of exonerating themselves: 'He who saves his Country does not violate any Law.' It is not difficult to imagine the alleged hacker aligning themselves even more closely with the Trump administration's whims moving forward — either because they agree with Trump's ideology or because they are hoping to stay out of jail.
It has certainly occurred to some of the Anime Nazi's followers that a hack can be used to humiliate political enemies. Derek Park — a cofounder of Nextnet, Inc, an AI company for life science researchers — tagged the alleged hacker into a discussion about getting ahold of Supreme Court Justice's Ketanji Brown Jackson's LSAT score. Park did not respond to a request for comment.
Scrolling through the Anime Nazi accounts was taking a bath in cruelty, contempt, and hate. Notably missing from those posts was anything like joy or happiness. It was further confirmation, if anyone needed it, of the observations in 'Who goes Nazi?', an essay by Dorothy Thompson published in 1941. 'Kind, good, happy, gentlemanly, secure people never go Nazi,' Thompson wrote. 'Those who haven't anything in them to tell them what they like and what they don't—whether it is breeding, or happiness, or wisdom, or a code, however old-fashioned or however modern, go Nazi.' That's as true of security professionals as it is of anyone else.
Additional reporting by Sarah Jeong.