A Canadian man has pleaded guilty to charges related to a widespread data theft scheme targeting accounts at cloud storage provider Snowflake. Connor Riley Moucka, 26, also known as Alexander Moucka and "Waifu," admitted to his involvement in accessing customer accounts and stealing data from at least 165 organizations, with the goal of extorting millions from victims. Moucka was arrested on October 30, 2024, following a series of attacks that occurred between February and October 2024.
Moucka and an alleged co-conspirator, John Erin Binns, exploited Snowflake accounts that lacked multi-factor authentication (MFA). They gained access using usernames and passwords previously compromised by infostealer malware. With MFA disabled, only valid credentials were required to log into customer accounts. Once inside, they reportedly used custom software to identify valuable information within cloud storage instances, including organization names, user roles, and IP addresses.
The stolen data, which spanned terabytes, included sensitive personal and financial information. Specific categories of data compromised were call and text history records (excluding content), banking and financial details, payroll records, Drug Enforcement Administration (DEA) registration numbers, driver's license numbers, passport numbers, Social Security numbers, and other personally identifiable information (PII).
Moucka and Binns attempted to extort numerous companies, ultimately receiving at least $2.5 million in Bitcoin from at least three victims. Moucka also sold stolen data on various hacker forums, earning at least $495,000 in fiat currency or cryptocurrency through these sales. In one instance, Moucka re-extorted a victim, threatening further disclosure of their stolen data, and reportedly used the stolen information of a government officer and immediate family members of a former government officer in this attempt.
According to the U.S. Department of Justice, victim companies incurred losses exceeding $9.5 million, and over 100 million individuals were affected by these Snowflake attacks. Moucka pleaded guilty to four counts: computer fraud, wire fraud, aggravated identity theft, and a related conspiracy. His sentencing is scheduled for October 27, and he faces a maximum sentence of 32 years in prison.
John Erin Binns, who resided in Turkey at the time of the attacks, was arrested there. While a local court approved an extradition request from U.S. prosecutors, the decision has been contested.
Among the organizations reported to be impacted by these breaches are AT&T, Ticketmaster, Santander, Pure Storage, Advance Auto Parts, Los Angeles Unified School District, QuoteWizard/LendingTree, and Neiman Marcus. In response to these incidents, Snowflake announced plans to enforce MFA protection and mandate a minimum password length of 14 characters for all accounts.
