A 26-year-old Canadian man, Connor Riley Moucka, has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud provider Snowflake. Moucka, of Kitchener, Ontario, also admitted to stealing call and text history records of more than 100 million AT&T customers.
Snowflake Data Thefts
The U.S. Justice Department said that between February and October 2024, Moucka and co-conspirators used stolen login credentials to steal cloud-hosted data belonging to at least 165 customers of a U.S.-based software-as-a-service company. The hackers targeted stolen credentials for Snowflake customer accounts that did not enforce multi-factor authentication, and extorted or attempted to extort a host of well-known companies, including TicketMaster, Lending Tree, Advance Auto Parts, and Neiman Marcus.
Consequences and Co-Conspirators
Moucka adopted new nicknames frequently, sometimes operating multiple identities concurrently, but two of his best-known monikers were 'Judische' and 'Waifu.' His admitted role in the Snowflake data thefts was first documented by KrebsOnSecurity in a September 2024 story about the overlap between Western, English-speaking cybercriminals and extremist groups that harass and extort minors into harming themselves or others.
One of Moucka's admitted co-conspirators is Cameron 'Kiberphant0m' Wagenius, a U.S. Army soldier who pleaded guilty in July 2025 to extorting AT&T and Verizon for their customer account data. Wagenius is set to be sentenced on September 3, 2026, and faces a maximum penalty of 20 years in prison for conspiracy to commit wire fraud, a maximum penalty of five years in prison for extortion in relation to computer fraud, and a mandatory two-year sentence consecutive to any other prison time for aggravated identity theft.
Investigation and Arrest
A little more than a month after the September 2024 story, Canadian authorities arrested Moucka on a provisional warrant from the United States. The government says Moucka and others used their unauthorized access to steal billions of sensitive customer records and download terabytes of information, including individuals' non-content call and text history records, banking and other financial information, payroll records, Drug Enforcement Administration (DEA) registration numbers, driver's license numbers, passport numbers, social security numbers, and other personally identifiable information.
Moucka also threatened and harassed government officials and security researchers who were helping to track him down. The Justice Department said the conspirators made over $2.5 million in ransom payments, and that in at least one instance, Moucka re-extorted a victim with threats of further disclosure of the victim's stolen data.
Sentencing and Future
Moucka pleaded guilty to four criminal counts, including computer fraud, wire fraud, aggravated identity theft, and conspiracy. He is slated to be sentenced on October 27 and faces a mandatory minimum penalty of two years in prison on the aggravated identity theft count, as well as a maximum penalty of 30 years in prison on the remaining counts.
Ultimately, it will be up to the federal judge to determine how much time Moucka actually serves for his extensive cybercriminal rap sheet. The case highlights the importance of enforcing multi-factor authentication and protecting sensitive customer records from cyber threats.
- TicketMaster
- Lending Tree
- Advance Auto Parts
- Neiman Marcus
The incident also raises concerns about the vulnerability of cloud-based services and the need for robust security measures to prevent such attacks in the future.
The government says Moucka and others used their unauthorized access to steal billions of sensitive customer records and download terabytes of information.
For more information on the case and the individuals involved, see the original report on Moucka's arrest.
Source: Krebs on Security