Actually, he was 16. He was a kid in India who had been acting as a Security Consultant to software firms since he was 13.

Here is a SecurityFocus article on him: The LIttlest Security Pro