Canadian Hacker Pleads Guilty to Snowflake Breaches and Extortion Scheme

Canadian Hacker Pleads Guilty to Snowflake Breaches and Extortion Scheme Connor Riley Moucka, a 26-year-old Canadian man known online as Judische and Waifu, has pleaded guilty to computer fraud, wire fraud, aggravated identity theft, and conspiracy for compromising more than 165 customer accounts at cloud provider Snowflake and stealing call and text records from over 100 million AT&T customers. Connor Riley Moucka pleaded guilty to four counts for hacking into over 165 Snowflake client accounts and collecting more than $2.5 million in extortion payments. The breaches targeted accounts lacking multi-factor authentication, affecting organizations such as Ticketmaster, Neiman Marcus, Lending Tree, and Advance Auto Parts. Co-conspirator Cameron Wagenius, an active-duty U.S. soldier who admitted to extortion schemes involving telecommunications data, faces sentencing in September 2026. A third alleged co-conspirator, John Erin Binns, reportedly secured Turkish citizenship following his release from a Turkish prison, shielding him from foreign extradition. Breach Mechanics and Victim Extortion Between February and October 2024, Moucka and co-conspirators accessed Snowflake customer accounts that failed to enforce multi-factor authentication using stolen login credentials. The intruders downloaded terabytes of sensitive information, encompassing payroll, financial, driver's license, passport, and DEA registration numbers, alongside call and text metadata from over 100 million AT&T customers. Victims were pressured into paying more than $2.5 million in ransoms under threats of publication, and Moucka re-extorted at least one victim using stolen data belonging to a government officer and their immediate family. Admitted Co-Conspirators and International Ties The conspiracy involved U.S. Army soldier Cameron Wagenius, operating under the alias Kiberphant0m, who pleaded guilty in July 2025 to extorting AT&T and Verizon. Following Moucka's arrest, Wagenius circulated claimed call logs for Donald Trump and Kamala Harris along with alleged NSA schematics. Another alleged co-conspirator, John Erin Binns, who had previously fled U.S. indictment over a 2021 T-Mobile data breach, was recently released from a Turkish prison and gained Turkish citizenship, which prevents foreign extradition. Plea and Sentencing Terms Following his arrest by Canadian authorities on a provisional U.S. warrant, Moucka entered guilty pleas to four criminal charges. He faces a mandatory minimum of two years in prison for aggravated identity theft and a statutory maximum of up to 30 years for the remaining charges, with final sentencing scheduled for October 27 before a federal judge.

涉 Snowflake 数据勒索案的加拿大男子认罪 26岁的加拿大籍男子 Connor Riley Moucka 就入侵并勒索使用云服务商 Snowflake 的165多家机构认罪，其盗取数据涵盖超1亿名 AT&T 客户记录，获利逾250万美元。 Connor Riley Moucka 承认犯下计算机欺诈、电信欺诈、加重身份盗窃及共谋等罪名，定于10月27日宣判，最高面临逾30年刑期。 团伙利用未开启多因素身份验证的被盗凭证入侵了至少165家 Snowflake 客户并实施敲诈，波及 TicketMaster、Neiman Marcus 等知名企业及海量个人敏感数据。 同谋美军士兵 Cameron Wagenius 已于2025年7月认罪并定于2026年9月宣判；另一同谋 John Erin Binns 已取得土耳其国籍以规避引渡。 大规模数据窃取与敲诈勒索 美国司法部指出，Moucka 及其同伙在2024年2月至10月期间，针对未强制开启多因素验证的 Snowflake 账户凭证发动攻击，窃取了包括 AT&T 逾1亿客户通话及短信记录、财务报表、护照号、社保号等在内的数TB敏感数据，随后威胁公开以勒索赎金。团伙累计获取超250万美元勒索金，受害者包括 TicketMaster、Lending Tree 和 Advance Auto Parts 等机构。Snowflake 事后加强了密码复杂度要求并强制推行多因素认证。 针对官员与调查人员的威胁 曾使用“Judische”和“Waifu”等化名的 Moucka，不仅威胁并骚扰追踪他的政府官员和安全研究人员，还在至少一起案件中使用政府官员及其家属的失窃数据进行二次勒索。Moucka 于2024年11月根据美国临时逮捕令在加拿大被捕，其罪名包括加重身份盗窃等四项指控，面临至少两年的强制监禁及最高30年的其余刑期。 两名共谋者的案件进展 本案同谋之一为美军士兵 Cameron Wagenius（代号 Kiberphant0m），其因勒索 AT&T 和 Verizon 客户数据已于2025年7月认罪，定于2026年9月宣判，面临数十年的最高法定刑期。另一名涉案共谋者为曾入侵 T-Mobile 的 John Erin Binns，消息人士透露其近期已从土耳其监狱获释并重新在网上活动；由于 Binns 近期获得了土耳其国籍，根据当地法律无法被引渡至外国受审。

A 26-year-old Canadian man once described as one of the most consequential cybercrime threat actors of 2024 has pleaded guilty to computer fraud and conspiracy to hack and extort more than 165 organizations that used the cloud provider **Snowflake**. **Connor Riley Moucka**, of Kitchener, Ontario, also admitted to stealing call and text history records of more than 100 million AT&T customers. The U.S. Justice Department said between February and October 2024, Moucka and co-conspirators used stolen login credentials to steal cloud-hosted data belonging to at least 165 customers of a U.S.-based software-as-a-service company. The hackers targeted stolen credentials for Snowflake customer accounts that did not enforce multi-factor authentication, and extorted or attempted to extort a host of well-known companies, including TicketMaster, Lending Tree, Advance Auto Parts and Neiman Marcus. Snowflake responded to the data thefts by increasing password complexity requirements and enforcing multi-factor authentication. Moucka adopted new nicknames frequently — sometimes operating multiple identities concurrently — but two of his best-known monikers were “**Judische**” and “**Waifu**.” Judische’s admitted role in the Snowflake data thefts was first documented by KrebsOnSecurity in [a September 2024 story](https://krebsonsecurity.com/2024/09/the-dark-nexus-between-harm-groups-and-the-com) about the overlap between Western, English-speaking cybercriminals and extremist groups that harass and extort minors into harming themselves or others. That September 2024 story identified Judische as a software engineer from Ontario who has been involved in numerous data breaches and voice phishing attacks against U.S. companies since at least 2020. A little more than a month later, Canadian authorities [arrested Moucka](https://krebsonsecurity.com/2024/11/canadian-man-arrested-in-snowflake-data-extortions/) on a provisional warrant from the United States. The government says Moucka and others used their unauthorized access to steal billions of sensitive customer records and download terabytes of information, “including individuals’ non-content call and text history records, banking and other financial information, payroll records, Drug Enforcement Administration (DEA) registration numbers, driver’s license numbers, passport numbers, social security numbers and other personally identifiable information. They then extorted victims by threatening to publish data online.” Moucka also threatened and harassed government officials and security researchers who were helping to track him down. The Justice Department said the conspirators made over $2.5 million in ransom payments, and that in at least one instance, Moucka re-extorted a victim with threats of further disclosure of the victim’s stolen data. “Moucka used the stolen data of a government officer and members of a then-former government officer’s immediate family in this re-extortion attempt,” reads [a statement](https://www.justice.gov/opa/pr/canadian-man-pleads-guilty-hacking-us-cloud-storage-provider-and-extorting-its-customers) from the Justice Department. One of Moucka’s admitted co-conspirators is **Cameron “Kiberphant0m” Wagenius**, a U.S. Army soldier who [pleaded guilty in July 2025](https://www.justice.gov/opa/pr/former-us-soldier-pleads-guilty-hacking-and-extortion-scheme-involving-telecommunications) to extorting AT&T and Verizon for their customer account data. Less than a month before Wagenius’s arrest, KrebsOnSecurity published [a deep dive](https://krebsonsecurity.com/2024/11/hacker-in-snowflake-extortions-may-be-a-u-s-soldier/) into Kiberphant0m’s various Telegram and Discord identities over the years, revealing how the owner of the accounts told others they were in the Army and stationed in South Korea. Kiberphant0m also re-extorted victims. Immediately following Moucka’s arrest, Kiberphant0m posted on hacker forums what he claimed were the AT&T call logs for then President-elect Donald Trump and for then Vice President Kamala Harris, as well schematics allegedly stolen from the U.S. National Security Agency (NSA). Wagenius is set to be sentenced on September 3, 2026. The government says he faces a maximum penalty of 20 years in prison for conspiracy to commit wire fraud, a maximum penalty of five years in prison for extortion in relation to computer fraud, and a mandatory two-year sentence consecutive to any other prison time for aggravated identity theft. The third alleged co-conspirator is **John Erin Binns**, 26, an elusive American man who fled the United States after being indicted for his admitted role in [a 2021 breach at T-Mobile](https://krebsonsecurity.com/2021/08/t-mobile-investigating-claims-of-massive-data-breach/) that exposed the personal information of at least 76 million customers. Sources close to the investigation said Binns, also known as “**IRDev**” and “**IntelSecrets**,” was until recently incarcerated in a Turkish prison, but that he has since been released and has resurfaced online. Those sources said Binns also recently obtained Turkish citizenship, and under Turkish law a citizen cannot be extradited to a foreign country. Moucka pleaded guilty to four criminal counts, including computer fraud, wire fraud, aggravated identity theft, and conspiracy. He is slated to be sentenced on Oct. 27 and faces a mandatory minimum penalty of two years in prison on the aggravated identity theft count, as well as a maximum penalty of 30 years in prison on the remaining counts. Ultimately, it will be up the federal judge how much time Moucka actually serves for his extensive cybercriminal rap sheet. For an interview with Moucka prior to his arrest and a deeper look at Binns, see [our original report on Moucka’s arrest](https://krebsonsecurity.com/2024/11/canadian-man-arrested-in-snowflake-data-extortions/).