Canadian Hacker Pleads Guilty to Massive Snowflake Data Theft
Connor Riley Moucka extorted millions by stealing data from over 165 companies.
1Large-Scale Cybercrimes
26-year-old Canadian Connor Riley Moucka, described as one of 2024's most impactful cybercriminals, pleaded guilty to hacking and extorting data from over 165 companies using Snowflake's cloud services. He also admitted to stealing call and text records of 100+ million AT&T customers. Charges include computer fraud, identity theft, and conspiracy. Moucka's activities marked him as a significant threat in the cybersecurity landscape during 2024.
2Targeted Companies and Methods
Between February-October 2024, Moucka and accomplices accessed Snowflake customer data using stolen credentials, specifically targeting accounts without multi-factor authentication. Major corporations like TicketMaster and Neiman Marcus faced ransom demands. Following these attacks, Snowflake strengthened password requirements and mandated MFA. The hackers exploited security gaps that many enterprises still hadn't addressed adequately in their cloud infrastructure.
3Millions of Sensitive Records Stolen
The stolen data included banking information, payroll records, DEA numbers, driver's licenses, passports, and Social Security numbers. The DOJ revealed the conspirators made over $2.5 million in ransom payments. Moucka engaged in 're-extortion,' repeatedly threatening some victims with further data exposure. In one instance, he used stolen government officer family data for secondary blackmail attempts, showing escalating boldness in his crimes.
4Accomplices and Related Crimes
Moucka's co-conspirators included U.S. Army soldier Cameron Wagenius (aka 'Kiberphant0m'), who extorted AT&T and Verizon customer data before pleading guilty in July 2025. Another associate, John Erin Binns, fled to Turkey after the 2021 T-Mobile breach exposing 76 million customers. Binns obtained Turkish citizenship to prevent extradition, demonstrating how cybercriminals exploit international legal loopholes to evade justice.
5Online Identities and Tracking
Operating under aliases like 'Judische' and 'Waifu,' Moucka maintained multiple concurrent identities. KrebsOnSecurity first connected Judische to Western cybercriminals and extremist groups in September 2024. Investigations revealed Moucka's involvement in data breaches and vishing attacks against U.S. companies since at least 2020. Canadian authorities arrested him in October 2024 under a U.S. provisional warrant, ending his four-year cybercrime spree.
6Targeting Government Officials
Moucka threatened security researchers and officials assisting his capture. After his arrest, accomplice Kiberphant0m leaked purported AT&T call logs of then-Vice President Kamala Harris and NSA schematics on hacker forums. Moucka's brazen targeting of government personnel demonstrated his disregard for consequences. His use of a government officer's family data for re-extortion showed particularly malicious intent in later crimes.
7Legal Proceedings and Potential Sentences
Moucka pleaded guilty to four counts including computer fraud and aggravated identity theft. Facing sentencing on October 27, he risks 2-30 years imprisonment. Wagenius awaits September 2026 sentencing with possible 20-year terms. These cases highlight growing judicial severity toward cybercrimes. However, Binns' evasion via Turkish citizenship shows persistent challenges in prosecuting international cybercriminals.
8Cybersecurity Wake-Up Call
The Moucka case exposed critical enterprise security vulnerabilities, particularly regarding MFA adoption. It revealed how coordinated international cybercriminal networks operate and exploit legal gaps. The incident has spurred calls for stronger global cybersecurity regulations and improved public-private cooperation in threat intelligence. As cloud adoption grows, this breach underscores the urgent need for robust identity management frameworks across industries.