Canadian Man Pleads Guilty in Massive Snowflake Data Breach Conspiracy
An Ontario man has pleaded guilty to charges related to the 2024 attacks on cloud data platform Snowflake, which resulted in approximately 165 data breaches.
Connor Riley Moucka, a 26-year-old Canadian national from Kitchener, Ontario, has pleaded guilty to multiple federal charges in a Washington state court, including computer fraud, wire fraud, aggravated identity theft, and conspiracy. The plea marks a significant development in the investigation into the widespread data breaches that exploited the cloud data storage platform Snowflake.
Moucka and his co-conspirators are accused of breaching Snowflake between February and October 2024 by using stolen login credentials. This access allowed them to exfiltrate vast amounts of sensitive data from at least 165 companies. The stolen information included banking records, financial details, Drug Enforcement Administration (DEA) registration numbers, driver's license numbers, passport numbers, and Social Security numbers, among other personal and corporate data.
The scale of the breaches was immense, impacting major organizations such as AT&T, Ticketmaster, Advance Auto Parts, Neiman Marcus, Santander, and LendingTree, as well as a large U.S. school district. The breach affecting AT&T alone compromised the call and text logs of over 100 million customers, while the Ticketmaster incident impacted approximately 560 million users.
Following the data theft, the hackers attempted to extort victim companies by threatening to publish the stolen information online. The group reportedly amassed around $2.5 million in ransom payments. Court documents revealed that Moucka engaged in further predatory tactics, including re-extorting at least one victim by leveraging the stolen data of a government official and their family.
In addition to ransom demands, Moucka also profited by selling some of the pilfered data on dark web forums like BreachForums and XSS.is, earning an additional $495,000. The total losses incurred by victim companies due to these breaches are estimated to be around $9.5 million.
Moucka was arrested in November 2024 and subsequently extradited to the United States in July 2025. FBI Special Agent in Charge W. Mike Herrington stated that Moucka's actions were "calculated and predatory," causing significant harm to both targeted companies and millions of individuals whose data was compromised.
An investigation by Google's Mandiant unit, hired by Snowflake, concluded that the platform itself did not suffer a security failure. Instead, the attackers exploited still-valid credentials that dated back to 2020, gaining access to company accounts through these compromised login details. Mandiant noted that the threat actors involved were primarily based in North America, with an additional member in Turkey.
Moucka is scheduled for sentencing on October 27 and faces a maximum prison sentence of 32 years. His guilty plea underscores the severe legal consequences for individuals involved in large-scale cybercrime operations targeting cloud infrastructure and customer data.
The Justice Department announced that Connor Moucka, a Canadian national, has pleaded guilty for his significant role in the widespread compromise of over 165 Snowflake customer environments. Moucka, who operated under aliases such as "Waifu" and "Judische," earned $495,000 through extortion and selling stolen data, and is linked to the broader cybercriminal network known as The Com. He faces up to 32 years in prison.
The Justice Department has revealed that Connor Riley Moucka personally profited at least $495,000 from the breaches through ransoms and data sales. Moucka also re-extorted at least one victim by threatening further disclosure of stolen data belonging to a government officer and their family. He faces a mandatory two-year sentence for identity theft and up to 30 years for other charges.
The article details the sentencing schedule for Connor Riley Moucka, with his plea hearing set for October 27. Moucka, arrested in October 2024, was extradited from Canada to the US in July 2025 after a multi-national law enforcement investigation. He faces a potential 30-year prison sentence for charges including computer fraud and aggravated identity theft.
The new article provides further details on the scope and impact of the conspiracy, specifying that the group accessed cloud-hosted data through stolen credentials, affecting at least 165 customers of a U.S.-based SaaS provider. It also elaborates on the types of sensitive data exfiltrated, including call and text history, banking details, and PII, and notes that the stolen datasets were advertised for sale on multiple dark web forums.
The article details the sentencing faced by Connor Riley Moucka, who pleaded guilty to multiple charges including computer fraud and aggravated identity theft. Moucka, also known as "Waifu" and "Judische," faces up to 32 years in prison and is scheduled for sentencing on October 27. His plea agreement highlights his role in accessing over 165 organizations' data via compromised Snowflake accounts, leading to significant financial losses for victims and their customers.
The article details the sentencing of Connor Riley Moucka, who pleaded guilty to four charges including computer fraud and aggravated identity theft. Moucka admitted to accessing over 150 Snowflake customer accounts using stolen credentials, exfiltrating sensitive data, and extorting victims for millions of dollars. He has agreed to forfeit over $495,000 in ransom payments and faces a mandatory minimum of two years in prison, with potential restitution costs totaling at least $9.5 million.
This latest report details Connor Riley Moucka's guilty plea to charges including computer fraud, wire fraud, aggravated identity theft, and conspiracy, with sentencing scheduled for October 27th. The plea agreement outlines his role in extorting over 165 organizations and stealing sensitive data, including call records of over 100 million AT&T customers, and highlights his re-extortion of a victim using compromised government officer data. The article also provides further details on his co-conspirators, Cameron Wagenius and John Binns, and their respective legal situations.
Connor Riley Moucka, 26, has pleaded guilty to computer fraud, wire fraud, aggravated identity theft, and conspiracy charges in a U.S. court. Moucka, who was extradited from Canada in July 2025, faces over 30 years in prison, with sentencing scheduled for October 27. He was part of a cybercrime group that accessed Snowflake accounts using stolen credentials, impacting 165 organizations and extorting victims for $2.5 million in ransom payments, while Moucka personally profited $500,000 from selling stolen data.