A 26-year-old Canadian man widely regarded as one of the most consequential cybercrime threat actors of 2024 has officially pleaded guilty to charges of computer fraud and conspiracy. Connor Riley Moucka, a resident of Kitchener, Ontario, admitted in federal court to his role in hacking and extorting more than 165 major organizations that utilized the cloud storage provider Snowflake. In addition to the sweeping cloud breaches, Moucka confessed to stealing the non-content call and text history records of more than 100 million AT&T customers, marking one of the most damaging telecommunications data thefts in recent history.
According to the U.S. Justice Department, the illegal campaign unfolded between February and October 2024. During this period, Moucka and his co-conspirators systematically exploited stolen login credentials to access and siphon massive quantities of cloud-hosted data belonging to at least 165 corporate and government customers of a prominent U.S.-based software-as-a-service company. The threat actors specifically hunted for Snowflake customer accounts that failed to enforce multi-factor authentication, using the absence of this basic security layer as an open gateway to compromise high-profile corporate networks.
The scope of the extortion campaign affected a host of household names and major enterprises, including TicketMaster, LendingTree, Advance Auto Parts, and Neiman Marcus. The fallout forced Snowflake to overhaul its security posture significantly, responding to the data thefts by implementing stricter password complexity requirements and mandating multi-factor authentication across its client ecosystem.
Operating under a rotating cast of handles and often maintaining multiple online personas simultaneously, Moucka became notorious within cybercrime forums. Two of his most frequently used monikers were "Judische" and "Waifu." The connection between "Judische" and the Snowflake data thefts was first brought to light by KrebsOnSecurity in a September 2024 investigative report, which detailed the troubling overlap between English-speaking cybercriminals and underground extremist groups that engage in the harassment and extortion of minors.
That initial reporting identified Judische as an Ontario-based software engineer who had spent years participating in data breaches and sophisticated voice phishing attacks targeting U.S. companies since at least 2020. Just over a month after those connections were made public, Canadian law enforcement officials apprehended Moucka on a provisional arrest warrant issued by the United States.
Federal investigators stated that Moucka and his accomplices leveraged their unauthorized access to steal billions of sensitive customer records, downloading terabytes of confidential information. The stolen trove included individuals’ non-content call and text histories, banking details, payroll documents, Drug Enforcement Administration (DEA) registration numbers, driver’s licenses, passports, Social Security numbers, and a wide array of other personally identifiable information. Armed with this sensitive data, the conspirators ruthlessly extorted their corporate victims by threatening to leak the information publicly online if ransom demands were not met.
The audacity of the criminal syndicate extended beyond corporate targets. Investigators revealed that Moucka actively threatened and harassed government officials and security researchers who were working to track down his digital footprint. According to the Justice Department, the conspirators amassed more than $2.5 million in ransom payments through their extortion schemes. In a particularly brazen display of malice, Moucka engaged in secondary extortion against at least one victim, threatening to release even more sensitive data after an initial ransom had already been paid.
Court documents detail that Moucka utilized the stolen personal data of a government officer and members of that former government officer’s immediate family to execute this re-extortion attempt.
Federal prosecutors have linked Moucka’s activities to a wider network of co-conspirators, including Cameron "Kiberphant0m" Wagenius, a U.S. Army soldier. Wagenius pleaded guilty in July 2025 to charges related to extorting telecommunications giants AT&T and Verizon for customer account data. Weeks prior to Wagenius’s arrest, security researchers published an in-depth analysis of his various Telegram and Discord accounts, tracking his online movements and revealing how the user frequently bragged about being stationed in the U.S. Army in South Korea.
Wagenius also engaged in retaliatory re-extortion tactics. Immediately following Moucka’s arrest, Wagenius posted what he claimed were AT&T call logs belonging to then President-elect Donald Trump and then Vice President Kamala Harris on hacker forums, alongside technical schematics allegedly stolen from the U.S. National Security Agency (NSA).
Wagenius is scheduled to be sentenced on September 3, 2026. The government maintains that he faces a maximum penalty of 20 years in prison for conspiracy to commit wire fraud, a maximum penalty of five years for extortion related to computer fraud, and a mandatory consecutive two-year prison sentence for aggravated identity theft.
A third individual named in the overarching criminal network is John Erin Binns, a 26-year-old American citizen who fled the United States after being indicted for his role in a massive 2021 data breach at T-Mobile that exposed the personal records of at least 76 million customers. Sources close to the ongoing investigation indicate that Binns—who has operated under aliases such as "IRDev" and "IntelSecrets"—was recently incarcerated in a Turkish prison before being released back into the online sphere. According to these sources, Binns successfully acquired Turkish citizenship during his time abroad, complicating any potential extradition efforts, as Turkish law generally prohibits the extradition of its citizens to foreign jurisdictions.
Following his guilty plea to four separate criminal counts, including computer fraud, wire fraud, aggravated identity theft, and conspiracy, Moucka is scheduled to be sentenced on October 27. He faces a mandatory minimum sentence of two years in federal prison specifically tied to the aggravated identity theft charge, alongside a maximum potential sentence of 30 years for the remaining counts. The final determination of his prison term rests with the federal judge presiding over the case, bringing a measure of accountability to one of the most disruptive cybercrime investigations of recent years.
