Canadian Hacker Connor Moucka Pleads Guilty in Snowflake Extortion Scheme

Snowflake extortion case expands with guilty plea

A 26‑year‑old Kitchener resident, Connor Riley Moucka, has entered a guilty plea on four counts, including computer fraud and aggravated identity theft, admitting his role in a sweeping Snowflake extortion operation that targeted more than ↓ 165 cloud‑based customers between February and October 2024.

The U.S. Justice Department outlined how Moucka and co‑conspirators harvested stolen credentials, bypassed weak authentication, and exfiltrated terabytes of data from firms such as Ticketmaster, LendingTree, Advance Auto Parts and Neiman Marcus. Snowflake responded by tightening password policies and mandating multi‑factor authentication.

“The defendants threatened to publish stolen records unless paid,” the Justice Department said, noting ransom demands exceeded ↑ $2.5 million.

Among the stolen files were call and text logs for over 100 million AT&T customers, banking details, payroll data, DEA registration numbers and passports. Moucka also used personal data of a government official and family members in a re‑extortion attempt.

Co‑accused include U.S. Army soldier Cameron “Kiberphant0m” Wagenius, who previously pleaded guilty to extorting AT&T and Verizon, and John Erin Binns, a fugitive linked to the 2021 T‑Mobile breach. Wagenius is slated for sentencing on September 3, 2026, facing up to 20 years.

Moucka’s sentencing is set for October 27. He faces a mandatory two‑year minimum for aggravated identity theft and up to 30 years on the remaining counts. The case highlights the lingering risk of cloud misconfiguration and the need for robust identity safeguards. For further details see Reuters and Bloomberg.