I read the article expecting to find some mitigating circumstances, like maybe he was underage. Turns out he's 22 and that sentence includes the punishment for other swatting calls, and DDoS attacks against French government sites. This seems like a shockingly lenient sentence, but I have to acknowledge that almost everything seems shockingly lenient when you come from a place with the largest incarcerated population in the world.
3 years of community service and mandatory mental health care will probably help this dude a lot more than locking him up for 5 years with violent criminals.