Cyber — 2026-08-07

Canadian Hacker Pleads Guilty in Snowflake Cloud Data Theft Affecting 165 Organizations

BLUFMoucka's plea closes the prosecution loop on two of three Snowflake conspirators but leaves the credential-theft supply chain and extortion forums that enabled a 165-company breach fully intact for successor crews.

Connor Riley Moucka, 26, of Kitchener, Ontario, pleaded guilty on Wednesday in Washington state federal court to computer fraud, wire fraud, aggravated identity theft and conspiracy for hacking cloud provider Snowflake and extorting more than 165 customer organizations between February and October 2024 123. Prosecutors said Moucka and co-conspirators used stolen credentials to steal call and text records of over 100 million AT&T customers along with banking data, driver's license numbers, Social Security numbers and other records from victims including Ticketmaster, Advance Auto Parts, Neiman Marcus, Santander and LendingTree 14. The Justice Department said the group collected more than $2.5 million in ransom payments plus roughly $495,000 from selling stolen data on forums including BreachForums, and that Moucka re-extorted at least one victim using stolen data belonging to a government officer and family members 24. Officials put victim companies' combined losses at about $9.5 million 4. Moucka is scheduled for sentencing on October 27 and faces up to 32 years in prison 25.

Analysis
Moucka's guilty plea locks in the Justice Department's cooperation-and-extradition strategy against The Com network, drawing on independently reported accounts from multiple outlets that converge on the plea's terms and victim scope. October 27 sentencing stands as the next fixed marker, with Wagenius's September 3 sentencing serving as an interim benchmark for how courts weigh the aggravated identity theft add-on. Binns remains beyond reach, reportedly holding Turkish citizenship that forecloses extradition, so the case resolves for two of three named conspirators. The plea more plausibly reflects forensic evidence tying Moucka directly to extortion communications than any broader collapse of the network's operational security, since successor extortion crews continue operating and Snowflake's new mandatory multi-factor authentication closes the credential-theft vector without touching the resale markets, including BreachForums, that sustain them.
6 sources
  1. Canadian Man Pleads Guilty in Snowflake Extortions - Krebs on Security
  2. Canadian man pleads guilty to Snowflake hacks that led to 165 breaches - The Record from Recorded Future News
  3. Hacker pleads guilty to stealing data from more than 165 Snowflake customers - TechCrunch
  4. Snowflake hacker pleads guilty, faces up to 32 years in prison - CyberScoop
  5. Canadian hacker pleads guilty in Snowflake data breach case, stealing data and extorting people for millions - CBC News
  6. Canadian Man Pleads Guilty to Hacking U.S. Cloud Storage Provider and Extorting Its Customers for Millions - U.S. Department of Justice, Office of Public Affairs

View in full brief →

UNCLASSIFIED // OPEN SOURCE