The St Louis Cardinals were stripped of their top two picks in this year’s amateur draft Monday and ordered to give them to Houston along with $2m as compensation for hacking the Astros’ email system and scouting database, the final step in an unusual case of cybercrime involving two Major League Baseball teams.

Baseball commissioner Rob Manfred also banned former St Louis executive Christopher Correa for life as he ruled the Cardinals must give the 56th and 75th draft choices in June to Houston. They must pay the Astros the money within 30 days. Correa, the Cardinals’ director of baseball development until July 2015, pleaded guilty in federal court to five counts of unauthorized access of a protected computer. He was sentenced last summer to 46 months in prison and ordered to pay the Astros $279,039 in restitution.

“Although Mr Correa’s conduct was not authorized by the Cardinals, as a matter of MLB policy, I am holding the Cardinals responsible for his conduct,” Manfred wrote. “A club suffers material harm when an employee of another club illegally accesses its confidential and propriety information, particularly intrusions of the nature and scope present here. In addition, as a result of Mr Correa’s conduct, the Astros suffered substantial negative publicity and had to endure the time, expense and distraction of both a lengthy government investigation and an MLB investigation.”

Cardinals chairman Bill DeWitt Jr said in a statement the “findings are fully consistent with our own investigation’s conclusion that this activity was isolated to a single individual.”

“This has been a long and challenging process for all of us, especially those within our baseball operations department,” St Louis general manager John Mozeliak said. “We have learned a great deal along the way and we have taken additional steps to ensure that something like this doesn’t ever happen again.”

Houston said “this unprecedented award by the commissioner’s office sends a clear message of the severity of these actions.”

Correa was employed by the Cardinals from 2009-15. When he was sentenced last July by US District Judge Lynn Hughes, Correa said he was “overwhelmed with remorse and regret for my actions” that cost him his career and his home.

“I violated my values and it was wrong. I behaved shamefully,” he said then. “The whole episode represents the worst thing I’ve done in my life by far.”

Astros general manager Jeff Luhnow told reporters in June 2014 the team had been the victim of hackers who accessed servers and published online months of internal trade talks. Astros general counsel Giles Kibbe said Correa accessed the Astros’ system about 60 times over two years.

The FBI said Correa was able to gain access using a password similar to that used by a Cardinals employee who “had to turn over his Cardinals-owned laptop to Correa along with the laptop’s password” when he was leaving for a job with the Astros in 2011. The employee was not identified; Luhnow quit St Louis for Houston in December of that year to become GM.

St. Louis already had lost its original top pick, No19, as compensation for signing free-agent outfielder Dexter Fowler. The Cardinals’ first pick now will be No94 overall. Houston will have five selections in the top 94. The Astros already had slots 15, 53 and 91.