Among the victims were gaming websites including Minecraft, Xbox Live and the computer game Runescape, the Old Bailey heard.
Adam Mudd, now 20, admitted more than 600 attacks himself, using malware he had created in 2013 which was used to carry out 1.7 million cyber attacks.
Runescape was targeted 25,000 times, 1.4 per cent of the total attacks, and in the last four years the company spent nearly £6 million in attempting to mitigate from DDoS attacks.
Mudd was 16 when he developed a programme called Titanium Stresser, the court heard. He set it up using a false name and an address in Manchester.
The Old Bailey heard that he also personally carried out 594 attacks, including one in 2014 targeting the Hempstead Road college campus where he was studying computer science at the time.
The teenager earned a total of 259.81 bitcoins - more than £386,000 worth of US dollars from selling the programme to international cyber criminals.
Mudd, who has Asperger syndrome, will serve his sentence in a young offenders institution. Giving him a job in GCHQ would have been more productive.
Ben Cooper, defending, appealed for his client to be given a suspended sentence. He said Mudd had been “sucked into” the cyber world of online gaming and was “lost in an alternate reality” after withdrawing from school because of bullying.
The judge said he could not suspend the jail term because he "needed the sentence to be a "real" deterrent to others".
Police said that when he was arrested in March 2015, Mudd was in the bedroom of his home in King's Langley and refused to unlock his computer until his father intervened.