A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata belonging to more than 100 million AT&T customers was sentenced to 70 months in federal prison. In addition to the prison term, handed down during a federal court hearing in Seattle, the defendant was ordered to pay nearly $300,000 in restitution to his victims.
Cameron John Wagenius, a 22-year-old soldier who was stationed at a U.S. Army base in South Korea at the time of his offenses, carried out his digital crimes under the online persona “Kiberphant0m.” Operating alongside a network of alleged co-conspirators, Wagenius exploited vulnerabilities stemming from exposed credentials and a lack of multi-factor authentication (MFA) within the cloud data storage service Snowflake. Following these incidents, Snowflake shifted its security posture to mandate MFA across all user accounts.
The scope of Wagenius’s illicit activities came to light in October 2024, when he began boasting on various cybercrime forums about having successfully downloaded vast troves of call and text metadata—including source and destination phone numbers, timestamps, and call durations—pertaining to tens of millions of AT&T customers. Beyond AT&T, Kiberphant0m claimed responsibility for breaching more than a dozen telecommunications companies worldwide, such as Verizon’s Push-to-Talk business. He publicly extorted these corporate entities, leveraging the threat of publishing sensitive proprietary and customer information unless they met his demands.
The investigation into Kiberphant0m’s true identity accelerated in late November 2025, when independent cybersecurity reporting from KrebsOnSecurity indicated that the prolific hacker was likely an active-duty U.S. soldier stationed in South Korea. Less than a month after those findings were published, federal law enforcement authorities arrested Wagenius. He was subsequently charged in two separate federal indictments and quickly entered guilty pleas across all counts in both cases.
Federal prosecutors pointed to Kenneth Schuchman, a 28-year-old resident of Vancouver, Washington, with a long history of cybercrime, as a key collaborator who assisted Wagenius in his efforts to extort the victimized companies. Schuchman’s involvement in illicit digital enterprises is well-documented; in 2019, he pleaded guilty to operating the Satori botnet, a massive infrastructure composed of compromised Internet-of-Things devices leveraged to launch devastating, large-scale distributed denial-of-service (DDoS) attacks.
Other alleged co-conspirators linked to the Snowflake data theft ring continue to navigate the judicial system. Conor Riley Moucka, operating under the online alias “Judische” in Kitchener, Ontario, was arrested in 2024 and entered a guilty plea in August 2026. Meanwhile, John Erin Binns, an American citizen currently residing in Turkey, remains wanted by authorities. Binns is also a principal suspect in a massive 2021 data breach at T-Mobile that exposed the sensitive personal details of at least 76 million customers.
As the extortion scheme unraveled, Wagenius engaged in increasingly desperate and erratic behavior, including re-extorting previous victims and threatening to leak sensitive national security secrets. Immediately following the arrest of Moucka—and despite AT&T having already paid the extortion syndicate a ransom of $370,000 in Bitcoin—Kiberphant0m published documents on hacker forums that he claimed were call logs belonging to then President-elect Donald Trump and then Vice President Kamala Harris. He also shared schematics allegedly stolen from the U.S. National Security Agency.
The case required an extraordinary multi-agency law enforcement response, drawing in the Defense Criminal Investigative Service (DCIS)—the investigative arm of the U.S. Department of Defense Office of Inspector General—alongside the Federal Bureau of Investigation, the Army Criminal Investigative Division, and the U.S. Secret Service. Paul Russell, a resident agent in charge at DCIS, noted that discovering an active-duty soldier holding a secret clearance who was actively manufacturing hacking tools and trafficking in stolen data was an exceptionally rare and alarming development. Russell observed that the unique nature of the insider threat immediately galvanized federal partners because investigators initially had no clear roadmap of the full extent of the compromised systems.
Complicating matters further, a sentencing memo filed by federal prosecutors in Seattle revealed that while Wagenius cooperated extensively after his guilty plea, he continued to test security boundaries while incarcerated. Government records indicate that while awaiting sentencing in September 2025, Wagenius exploited the email system of a fellow inmate to request that the recipient prompt commercial artificial intelligence tools for information regarding privilege escalation vulnerabilities and bypasses in Windows 10 Enterprise, explicitly asking for working scripts with unomitted code.
Days later, Wagenius used another inmate’s account to solicit step-by-step instructions and code for CVE-2023-45208, a command injection vulnerability affecting D-Link networking devices. Around the same time, he solicited guidance on constructing makeshift antennas using commissary items to extend radio reception inside a correctional facility, alongside inquiries regarding prison escape methods. Prosecutors noted that Wagenius frequently framed these AI queries as research for a book he claimed to be writing—a classic prompt-injection tactic designed to bypass safety filters built into commercial AI models to prevent the generation of malicious exploit code.
Although federal prosecutors stated there was no evidence that Wagenius successfully deployed these researched vulnerabilities within Bureau of Prisons systems, and while he maintained that he was merely researching potential flaws to assist authorities, the episode underscored his persistent technical fixation.
Despite the staggering corporate profile of his victims and the immense sensitivity of the data he targeted, financial audits revealed that Wagenius’s cybercriminal enterprise was remarkably unsuccessful from a monetary standpoint. According to the government’s sentencing memo, Wagenius earned a total of roughly $1,500 from selling stolen data. Prosecutors emphasized that despite his negligible financial return, his actions intentionally inflicted profound harm on individual citizens, major corporate entities, and the national security apparatus of the United States.
