U.S. Soldier Gets 70 Months for Extorting AT&T and Verizon

A U.S. Army soldier who pleaded guilty to breaking into several telecommunications companies and stealing the call and text metadata of more than 100 million AT&T customers in 2024 has been sentenced to 70 months in federal prison. The court also ordered him to pay victims nearly $300,000 in restitution.

A hacker in uniform

Cameron John Wagenius, 22, was stationed at a U.S. Army base in South Korea when he took up the cybercriminal persona "Kiberphant0m." Along with three alleged co-conspirators, he downloaded data from large customers of the cloud storage service Snowflake — accounts whose credentials had been exposed and that did not enforce multi-factor authentication (Snowflake has since made MFA mandatory for everyone).

In October 2024, Kiberphant0m boasted on cybercrime forums that he had stolen the call and text metadata of tens of millions of AT&T customers: source and destination numbers, timestamps, durations, and more. He claimed to have breached more than a dozen telecom operators worldwide, including Verizon's Push-to-Talk business, and publicly extorted them in exchange for a promise not to release the data.

How he was caught

In late November 2025, KrebsOnSecurity warned that Kiberphant0m was likely a U.S. soldier stationed in South Korea. Less than a month later, Wagenius was arrested, charged in two separate federal indictments, and soon pleaded guilty on all counts. At his hearing in Seattle he received nearly six years in prison and a $294,978 fine.

Prosecutors said he was aided by Kenneth Schuchman of Vancouver, Washington, who had already been convicted in 2019 for running the Satori botnet. Two other alleged accomplices remain: Conor Riley Moucka ("Judische") of Ontario, who pleaded guilty in August 2026, and John Erin Binns, who lives in Turkey and is also wanted over the 2021 T-Mobile breach.

After Moucka's arrest — with AT&T having already paid the group a $370,000 Bitcoin ransom — Kiberphant0m posted what he called the call logs of President-elect Donald Trump and Vice President Kamala Harris, along with schematics he claimed were stolen from the NSA.

The story continued behind bars

Investigators note that Wagenius cooperated extensively, yet even in prison he did not stop. Using other inmates' email accounts, he asked recipients to prompt a commercial AI tool for information about Windows 10 vulnerabilities, a three-year-old flaw in D-Link gear, how to build an antenna from commissary items, and how to escape prison. He framed the queries as research for a book he was writing — a classic "prompt injection" meant to bypass an AI's safeguards against producing malicious code.

Most striking is the ending: despite the enormous value of the stolen data, the extortion was almost a complete failure. According to prosecutors, Wagenius earned a grand total of about $1,500 from selling the stolen information.

Source: Krebs on Security