Mastermind of the Snowflake Cloud Breaches: Canadian Hacker Connor Riley Moucka Pleads Guilty in Massive Extortion Scheme

WASHINGTON — A 26-year-old Canadian national, once flagged by cybersecurity analysts as one of the most destructive and consequential threat actors of 2024, has officially pleaded guilty to a slate of federal cybercrimes. Connor Riley Moucka, hailing from Kitchener, Ontario, entered his guilty plea to charges of computer fraud, wire fraud, aggravated identity theft, and conspiracy.

Moucka’s admissions bring a pivotal chapter to a sprawling, multi-national investigation into a devastating cyber extortion campaign. Between February and October 2024, Moucka and an international cadre of co-conspirators exploited vulnerable cloud-storage accounts belonging to major software-as-a-service (SaaS) provider Snowflake. Operating under notorious online aliases such as "Judische" and "Waifu," Moucka and his network breached more than 165 high-profile corporate and government entities, siphoning terabytes of sensitive data and extorting millions of dollars.

Beyond the corporate cloud breaches, Moucka’s guilty plea addresses his admission to stealing the non-content call and text history records of more than 100 million AT&T customers. As federal prosecutors prepare for sentencing hearings that could land Moucka and his co-conspirators behind bars for decades, the case serves as a stark watershed moment for cloud security, corporate vulnerability management, and the overlapping threat landscapes of domestic extremism and elite cybercrime.

Main Facts: The Scope and Scale of the Cloud Extortion

The operation orchestrated by Moucka and his associates represented one of the most damaging corporate data breaches in recent history. Leveraging compromised credentials that bypassed security parameters—specifically targeting accounts devoid of multi-factor authentication (MFA)—the threat actors gained unauthorized entry into Snowflake cloud tenant environments utilized by globally recognized brands.

Among the corporate victims forced to navigate the hackers’ extortion demands were household names such as TicketMaster, LendingTree, Advance Auto Parts, and Neiman Marcus. The stolen repository was not limited to corporate memos; it encompassed an astronomical volume of personally identifiable information (PII). According to the U.S. Department of Justice (DOJ), the group looted:

• Non-content call and text history records impacting over 100 million telecommunications customers.
• Banking and sensitive financial details.
• Corporate payroll records.
• Drug Enforcement Administration (DEA) registration numbers.
• State-issued driver’s license numbers, foreign and domestic passport numbers, and Social Security Numbers (SSNs).

Faced with the threat of having this massive cache of proprietary and consumer data dumped publicly on dark web forums or leaked directly to competitors, victim organizations paid upwards of $2.5 million in extortion ransoms.

However, Moucka’s criminal conduct extended beyond corporate extortion into malicious personal harassment. The DOJ revealed that Moucka routinely threatened and harassed government officials and cybersecurity researchers who were actively working to track him down. In at least one particularly brazen instance of "re-extortion," Moucka weaponized the stolen data of a government officer—and members of that official’s immediate family—to exert further pressure after an initial ransom had already been paid or negotiated.

Chronology of an Investigation: From Dark Web Nexus to Arrest

The unraveling of Connor Riley Moucka’s criminal enterprise is a masterclass in modern digital forensics, investigative journalism, and international law enforcement cooperation.

Early Foundations and Voice Phishing (2020–2023)

Long before his name dominated the headlines of the cybersecurity sector, Moucka was actively operating within Western, English-speaking cybercrime forums. Working as a software engineer from his base in Ontario, he honed his tradecraft through voice phishing (vishing) attacks targeting various U.S. corporations starting around 2020. Over the years, he fluidly adopted numerous online monikers, often running multiple digital identities concurrently to obfuscate his tracks.

The Dark Nexus Exposed (September 2024)

The spotlight intensified on Moucka in September 2024, when investigative reporting by KrebsOnSecurity published a breakthrough story detailing the dark nexus between Western cybercriminal syndicates and extremist groups that harass and extort minors into self-harm. This reporting formally identified "Judische" as an Ontario-based software engineer central to the sprawling Snowflake data thefts.

The Cloak Slips (October 2024)

As investigators closed in, Royal Canadian Mounted Police (RCMP) surveillance captured images of Moucka on October 21, 2024—just nine days before his eventual apprehension. Operating under his various personas, Moucka continued his aggressive campaigns, even as the walls closed in. On October 30, 2024, acting on a provisional arrest warrant issued by the United States, Canadian authorities executed a raid and arrested Moucka in Ontario, neutralizing one of the year’s most prolific threat actors.

The Guilty Plea and Upcoming Sentencing (2025–2026)

Following his extradition process and subsequent legal proceedings in U.S. federal court, Moucka formally entered his guilty plea to four criminal counts. He faces a mandatory minimum sentence of two years in prison for aggravated identity theft, running consecutively with a maximum penalty of up to 30 years for the remaining counts of computer fraud, wire fraud, and conspiracy. His formal sentencing is scheduled for October 27, 2026, where a federal judge will determine the final extent of his imprisonment.

Supporting Data: The Co-Conspirators and Global Reach

Moucka did not operate in a vacuum. Federal indictments and investigative breakthroughs have mapped out a tightly knit, highly destructive international network of hackers whose actions intertwined telecommunications breaches, military security breaches, and geopolitical sanctuaries.

Cameron "Kiberphant0m" Wagenius

One of Moucka’s primary admitted co-conspirators was Cameron Wagenius, a U.S. Army soldier who operated online under the handle "Kiberphant0m." Operating from military installations—including posts in South Korea—Wagenius specialized in targeting telecommunications giants like AT&T and Verizon.

Wagenius pleaded guilty in July 2025 to charges stemming from his role in the hacking and extortion scheme. Much like Moucka, Wagenius frequently engaged in secondary extortion tactics. Immediately following Moucka’s arrest in late 2024, Wagenius defiantly posted what he claimed were AT&T call logs belonging to then-President-elect Donald Trump and then-Vice President Kamala Harris on hacker forums, alongside classified-looking schematics allegedly stolen from the U.S. National Security Agency (NSA). Wagenius is scheduled to be sentenced on September 3, 2026, facing up to 20 years for wire fraud conspiracy, 5 years for computer fraud extortion, and a mandatory consecutive two-year term for aggravated identity theft.

John Erin Binns ("IRDev" / "IntelSecrets")

The third pillar of the alleged conspiracy is John Erin Binns, a 26-year-old American fugitive. Binns first rose to international notoriety following his indictment for a massive 2021 data breach at T-Mobile that exposed the records of at least 76 million customers.

According to sources close to the investigation, Binns fled the United States and was incarcerated for a period in a Turkish prison. Following his release, Binns resurfaced online having acquired Turkish citizenship. Under Turkish constitutional and legal frameworks, citizens cannot be extradited to foreign jurisdictions, rendering Binns largely insulated from direct U.S. extradition attempts while continuing to loom large over the broader cybercrime ecosystem.

Official Responses: Corporate Reckoning and Government Action

The fallout from the Snowflake and AT&T breaches prompted immediate, aggressive defensive postures from both the targeted private entities and federal law enforcement agencies.

The Department of Justice heralded the guilty pleas of Moucka and Wagenius as a vital victory for national security and consumer protection. Assistant Attorney General and high-ranking DOJ officials emphasized that the disruption of these transnational hacking rings sends an unequivocal message to cybercriminals who believe geographic borders or encrypted messaging applications on platforms like Telegram and Discord can shield them from justice.

For Snowflake, the attacks acted as a brutal, high-profile stress test of its cloud security architecture. The SaaS provider swiftly instituted sweeping infrastructural mandates to stymie credential-stuffing and unauthorized access vectors. These measures included:

• Enforcing strict password complexity requirements across all customer tenants.
• Mandating multi-factor authentication (MFA) for all user accounts, effectively closing the primary vulnerability exploited by Moucka and his co-conspirators.

Industry watchdogs noted that while Snowflake’s platform security itself was not fundamentally compromised by software vulnerabilities, the widespread failure of client-side hygiene—specifically the neglect of foundational MFA protocols—exposed the inherent risks of shared responsibility models in cloud computing.

Implications: The Future of Cloud Security and Insider Threats

The Connor Riley Moucka case carries profound, long-term implications for the cybersecurity landscape, corporate governance, and national defense protocols.

1. The Perils of Credential Neglect: The Snowflake breaches underscore a persistent human vulnerability in digital security. Despite years of awareness campaigns, organizations continue to overlook basic access controls. The reliance on single-factor authentication for high-value enterprise cloud environments provided threat actors with a low-friction entry point to cause billions of dollars in systemic damage.
2. The Militarization of Cybercrime: The involvement of active-duty U.S. Army soldier Cameron Wagenius highlights a troubling evolution in insider and military threats. The intersection of trained military personnel engaging in transnational extortion using operational security tactics learned or honed during service presents a severe counterintelligence challenge for the Department of Defense.
3. Geopolitical Sanctuaries and Fugitives: The case of John Erin Binns illustrates the persistent headache of international extradition bottlenecks. As cybercriminals leverage dual citizenships and legal loopholes in non-extradition nations (such as Turkey), law enforcement must increasingly rely on unconventional disruption operations, international pressure, and long-term asset tracking to curb the impunity of fugitive hackers.
4. The Weaponization of Re-Extortion: Moucka and Wagenius pioneered a ruthless playbook of "re-extortion," targeting not just corporations, but government officials, investigators, and family members. This escalation transforms routine data breaches into targeted harassment campaigns, necessitating enhanced threat intelligence and personal security measures for public servants and cybersecurity researchers alike.

As Connor Riley Moucka awaits his final sentencing in October 2026, the digital forensics community continues to sift through the wreckage of the 2024 cloud extortions. The case remains a defining textbook example of how a small, highly coordinated cell of digital actors can leverage basic operational oversights into a multi-million-dollar global crisis—and how relentless, cross-border law enforcement ultimately brings the architects of chaos to justice.