
449 N.W.2d 376 (1989)
STATE of Iowa, Appellee,
v.
Timothy HOLMBERG, Appellant.
No. 88-1825.
Supreme Court of Iowa.
December 20, 1989.
David A. O'Brien of O'Brien, Galvin & Kuehl, Sioux City, for appellant.
Thomas J. Miller, Atty. Gen., Mark Joel Zbieroski, Asst. Atty. Gen., and Thomas S. Mullen, County Atty., for appellee.
Considered by McGIVERIN, C.J., and HARRIS, LARSON, SCHULTZ, and ANDREASEN, JJ.
HARRIS, Justice.
The challenge here is to the trial court's order of victim restitution. The defendant complains that the order exceeded his involvement in a computer theft and therefore exceeded the trial court's authority. While we disagree with the defendant's assessment of a sentencing court's authority under the restitution chapter, we do agree that the authority was exceeded here. We reverse and remand.
*377 Defendant Timothy Holmberg was charged with computer theft in the first degree by making unauthorized use of the victim's phone lines. First-degree computer theft is defined as one resulting "in a loss of services or property of more than $5000." Iowa Code § 716A.10 (1987). Holmberg is a twenty-three-year-old who lives at home with his parents. He is trained and skilled as a computer programmer and operator. He keeps a computer in his room at home, often accessing other computers for information and computer games.
He did not plead guilty to first-degree computer theft. Rather, in accordance with a plea bargain, he entered his plea to computer theft in the third degree. Iowa Code § 716A.12 (more than $100 but not more than $500). The lesser plea was accepted and a restitution hearing was held.
At the restitution hearing the defendant admitted accessing the victim "80 to 100 times," but specifically denied accessing anywhere nearly so often as claimed by the victim. The trial court ordered the payment of $12,603.27 in restitution, the amount asserted by the victim.
I. Except for motor vehicle violations under Iowa Code chapter 321, an Iowa statute requires restitution in all criminal cases where guilt is established. Iowa Code § 910.2. Section 910.1(4) defines "restitution" as:
payment of pecuniary damages to a victim in an amount and in the manner provided by the offender's plan of restitution. Restitution shall also include the payment of court costs, court-appointed attorney's fees or the expense of a public defender, and the performance of a public service by an offender in an amount set by the court when the offender cannot reasonably pay all or part of the court costs, court-appointed attorney's fees or the expense of a public defender.
Section 910.1(2) defines "pecuniary damages" as:
All damages to the extent not paid by an insurer, which a victim could recover against the offender in a civil action arising out of the same facts or event, except punitive damages and damages for pain, suffering, mental anguish, and loss of consortium. Without limitation, "pecuniary damages" includes damages for wrongful death.
In State v. Zaruba, 306 N.W.2d 772 (Iowa 1981), we held that a drug trafficker could not be required to make restitution to the state for monies used to purchase drugs for those crimes on which he was acquitted. Id. at 775.
We also interpreted the restitution statute in State v. Starkey, 437 N.W.2d 573 (Iowa 1989). We held that a restitution order must rest on a causal connection between the established criminal act and the injuries to the victim. When this is established, the statute allows recovery of "all damages" (with exceptions not involved here) which the State can show by a preponderance of the evidence. Id. at 574. We think our review of a sentencing court's findings should be on error.
Defendant argues that the restitution order must be limited by the parameters of the offense to which he entered his guilty plea, in this case $500. This view is at odds with our holdings in both Zaruba and Starkey. Under these cases the order can be extended to any amount which would be appropriate for tort recovery.[1]
We thus agree in general with the State's views on a sentencing court's authority to order restitution. We nevertheless find authority was lacking for the restitution order entered against this defendant. This is because there was insufficient proof of Holmberg's involvement in any amount in excess of the $500 he admitted in his plea. There was evidence from which the court could have found the victim was damaged in an amount approaching the figure claimed. But there was a *378 wholesale failure of proof that this defendant was the one responsible for it. On this record involvement was established only to the extent Holmberg admitted $500.
The only evidence offered which connects the defendant with the loss falls decidedly short of showing Holmberg was Sioux City's only, or even principal, "hacker." The company witness stated:
We keep records of every authorization code that is compromised by a hacker, and when we change the code we always check back to see if any calls were placed on that code. In this case all these codes were hacked through Sioux City and the calls that were placed originated from Sioux City on those codes and the dialed numbers matched, the numbers that were used to gather the code.
. . . .
When we use the trap and trace [the defendant] was using the same phone numbers that he had typically used over this entire period of time, and when we trapped his phone number through Northwestern Bell he was still using these same numbers. When the search warrant was executed the records that were in his possession showed the authorization codes that we had attributed to our Sioux City hacker and they matched.
In finding this defendant responsible for $12,000 of involvement, the trial court cited only the fact that defendant, when entering his plea, "admitted as true the minutes of testimony." These, according to the trial court, reflected damages in excess of $12,000. Inasmuch as the defendant's plea was to the lesser offense we do not think this can fairly stand as a fair appraisal of the defendant's admission.
The judgment of the trial court must be reversed and the case remanded for entry of a restitution order limiting to $500 the actual damages to the victim.
REVERSED AND REMANDED.
NOTES
[1]  There are however limitations to the analogy with tort law. Restitution serves more than a tort purpose; it has as well a rehabilitative and penal purpose. Kelly v. Robinson, 479 U.S. 36, 107 S.Ct. 353, 93 L.Ed.2d 216 (1986). We indicated that restitution serves a secondary rehabilitative purpose in State v. Haines, 360 N.W.2d 791, 795 (Iowa 1985).
