Connor Riley Moucka, 26, of Kitchener, Ontario, admitted computer fraud, wire fraud, aggravated identity theft and conspiracy in federal court in Washington state. He is scheduled to be sentenced on October 27 and faces a maximum combined prison term of 32 years.
The guilty plea marks a major development in the investigation of one of the most extensive corporate data-theft campaigns linked to cloud accounts. Moucka and his co-conspirators used stolen login credentials to enter customer-controlled Snowflake environments and download large quantities of information before demanding payments to prevent disclosure or sale of the material.
The operation affected more than 165 organisations and involved the theft of billions of sensitive records. Data taken during the campaign included banking and financial information, payroll records, driver’s licence numbers, passport details, Social Security numbers, government registration information and call and text metadata.
Companies publicly connected to the wider campaign included AT&T, Ticketmaster, Santander, Advance Auto Parts, LendingTree and Neiman Marcus. The AT&T intrusion exposed call and text interaction records associated with more than 100 million customers, while the Ticketmaster breach involved information linked to hundreds of millions of users.
The attackers demanded ransoms from victim companies after extracting their data, threatening to publish or sell the information if payments were refused. The conspiracy generated more than $2.5 million in ransom payments, while Moucka personally obtained at least $495,000 through extortion and the sale or attempted sale of stolen material. Victim organisations suffered more than $9.5 million in direct losses, excluding losses incurred by their customers.
Court records also describe an attempt by Moucka to extort one organisation for a second time. Information used during that effort included personal data belonging to a government official and relatives of a former government official. Stolen datasets were advertised on cybercrime platforms including BreachForums, Exploit. in and XSS. is, as well as through Telegram channels.
The intrusions did not rely on exploiting a vulnerability in Snowflake’s underlying cloud infrastructure. Investigators determined that attackers obtained valid credentials, including passwords stolen through information-stealing malware, and used them to enter individual customer environments. Many of the targeted accounts did not have multi-factor authentication enabled.
That distinction made the campaign an important case study in the growing risks surrounding cloud identity management. Companies increasingly store vast quantities of corporate and customer information with cloud providers, but compromised credentials can give attackers access even when the underlying platform has not suffered a technical breach.
Security investigators examining the attacks found credentials associated with some compromised accounts had been exposed years before the Snowflake campaign. Stolen usernames and passwords remained usable because they had not been rotated, while the absence of multi-factor authentication allowed attackers to authenticate without an additional verification step.
Moucka was arrested in Kitchener on October 30, 2024, following a request from US authorities. He later agreed to surrender for extradition proceedings and appeared in the Western District of Washington in July 2025, initially pleading not guilty and remaining in custody.
The original federal case also named John Erin Binns, who has been accused of participating in related hacking and extortion activity. Binns is not currently in US custody and the allegations against him remain unproven unless established in court.
Investigators say the broader conspiracy operated across borders and combined credential theft, large-scale cloud data extraction and conventional extortion. Rather than encrypting corporate systems in the manner commonly associated with ransomware, the attackers relied on possession of stolen information as leverage, threatening disclosure unless companies paid.
The Snowflake campaign accelerated scrutiny of authentication controls protecting cloud databases and data warehouses. Organisations were urged to enforce multi-factor authentication, rotate exposed credentials, restrict network access and monitor accounts for unusual activity after investigators identified the scale of the compromises in 2024.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
