Ok, let me dig. It's been a while and I'm not a lawyer.
Looking at the actual indictment, I think he was charged with just violating Section 1030 (a)(5)(A)(i) of the U.S. Code. I don't think the other two sections mentioned are separate charges.
http://www.law.cornell.edu/uscode/html/uscode18/usc_sec_18_0...
If you've never read section 1030, it's surprisingly clumsy and vague to us non-lawyers. Two important things for most cases are that generally any computer that is (or even 'can be') connected to the internet is considered to be 'protected' as it may potentially be involved in interstate commerce. The second this is that for this section to apply, there must be at least $5000 in damages involved.
Then you can go look up sentencing guidelines. It's important to realize that these 'guidelines' are a lot more than just suggestions for federal judges. They can go outside of these guidelines but rarely do. http://www.sentencing.us has a great calculator. That quickly tells us to use section 2B1.1(a)(2) of the guidelines.
http://www.ussc.gov/Guidelines/2010_guidelines/Manual_HTML/2...
If you go look at those guidelines, there's a chart in (b)(1) that shows how much his base offense level would be increased depending on the damages. From the descriptions I've read, I would think the damage amount would be less than $120,000 (lost time, hours it took to clean up) so that's a +8 level increase.
Then there are a number of special modifiers that can increase the 'level' of the sentence guideline. It looks like (b)(14)(B) might apply due to the financial institution aspect, so that would be a +4, except if I read the awkward combination of (C) and (D) correctly, this automatically pushes him to a level 24.
So then you need to look at the sentencing table:
http://www.ussc.gov/Guidelines/2010_guidelines/Manual_HTML/5...
The table takes his criminal history into account, which was likely none. Then we need to look at his level, which we still don't know.
If he caused under $120,000 in damages, his level should be a base of 6 plus 8 for the dollar amount. He could reduce this by 1 or 2 levels by accepting responsibility or other things. But if he was at a level 14, his sentence guideline should be 15-21 months. I would think that the damage amount could be even lower than that, especially if it had to be proved in trial. This is why I made my original statement that I thought it sounded quite high.
So they must have applied the (b)(14)(B) part to push him to level 24 for a range of 51-63. In which case his sentence of 41 months is then too low. So if he "accepted responsibility" he could reduce his 24 to a 22, getting him right at the 41-51 month range. Judges would almost always apply the lowest end of the range to a first time offender.
I think his 41 months can be split into two phases so he could spend half of it in an actual prison and then the rest on 'supervised release' - either monitored home detention or in a halfway house. He might even be able to spend the entire time on 'supervised release'. I couldn't find it but section 1030 offenses used to have a clause about mandatory 6 months 'imprisonment'.
Due to his offense level, he could have gotten 5 years probation, but 3 is typical. He will be required to make restitution to the victim for the damage amount. There's also a fine table that shows him with a $7,500 to $75,000 fine range. He'll have to make his best effort to pay those.
So that's the mechanics of federal sentencing.
This is something I wish they covered in every school program. It's amazing to realize that one angry act by a programmer or IT person could result in very severe consequences. So few people in our field realize how stiff the penalties can be, so this law isn't much of a deterrent.