I did a similar analysis a few years back. http://rafekettler.com/2011/06/16/analyzing-the-lulzsec-pass...