Hacker Who Breached Snowflake Customers Pleads Guilty: At Least 100 Million People Affected

Connor Riley Moucka, 26, of Kitchener, Canada, pleaded guilty on Wednesday in federal court in Seattle to charges of computer and wire fraud, aggravated identity theft, and a related conspiracy. The case concerns a series of breaches of customer accounts on the Snowflake cloud platform in 2024. The attacks hit at least 165 organizations and exposed the data of at least 100 million people; Moucka personally netted no less than $495,000 from ransoms and the sale of stolen data.

Sentencing is expected on October 27. The identity theft count carries a mandatory minimum of two years, while the other counts carry up to 30 years in prison.

No Exploit, No Vulnerability

The most striking part is exactly how the attackers got in. There was no breach of the platform itself. The credentials had been harvested by infostealers years before the attacks and had simply never been changed, and multi-factor authentication was disabled on the compromised accounts. Mandiant, which investigated the incident alongside Snowflake and tracks the group as UNC5537, determined that every episode came down to stolen customer passwords. Some of them had been lifted as far back as November 2020 and remained valid for years: at least 79.7% of the accounts used had already appeared in leaks, and they had no network access lists in place.

Mandiant itself explicitly noted that the campaign “is not the result of any particularly novel or sophisticated tool, technique, or procedure.” It all rested on the scale of the infostealer market and on passwords that had gone unchanged for as long as four years.

What Leaked

Among the stolen data were call and message histories (without content), payroll records, DEA registration numbers, and passport and Social Security numbers. In July 2024, AT&T confirmed that records of the calls and messages of nearly all its mobile subscribers for the period from May to October 2022 had been stolen from its workspace on a third-party cloud. The combined direct damage to the affected companies exceeded $9.5 million — not counting the losses of their own customers.

Prosecutors allege that Moucka re-extorted at least one victim, threatening to release the stolen data of a government employee and the family members of a former official. FBI Special Agent Mike Herrington called the tactic “calculated and predatory.”

Of the two people charged in 2024, only Moucka is in custody in the U.S.; his co-defendant, John Erin Binns, remains at large. Cameron John Wagenius, a former service member linked to the same attacks, pleaded guilty in a related case in July 2025.

Since October 2024, Snowflake has enabled MFA by default for new accounts, but password-only sign-in has not yet been fully retired: according to the platform's documentation, the final phase-out of passwords as the sole factor is stretched out to October 2026.

Source: The Hacker News