As much as this guy deserves some kind of punishment for the horrible way he has treated people over the years, he doesn't deserve 4 years for being a class-a asshole to people. What he did wasn't a hack, heck he didn't even write the script that apparently scraped the data from the URL. A 12 year old kid with an introduction to PHP book could even write a PHP script that did what Weev did, it's not a hack it's a cheap exploit (I've done this with sites like Google & Yahoo for scraping search results before). AT&T are somewhat to blame for failing to protect the privacy of their customers in this instance, a company has a duty of responsibility to ensure it takes reasonable measures to protect customer data.
If I were the judge, I would have sentenced him to maybe 1 year (for releasing the info publicly), maybe made him serve 6 months of the sentence and given him a 3 year good behaviour bond with some conditions on getting some counselling for his obvious narcissism problem. The justice system really needs to get with the times, because these computer related hacking/cracking/exploiting incidents are only going to continue being a more common occurrence. The justice system is riddled with judges in their mid to late 60's who were raised in a non-Internet world and thus cannot truly understand the depth cases like these have or comprehend the extent as to how these defendants should be prosecuted.