A U.S. Army soldier who admitted to hacking into multiple telecommunications corporations, stealing sensitive mobile call and text metadata belonging to more than 100 million AT&T customers, and orchestrating high-profile extortion schemes was sentenced to 70 months in federal prison. In addition to his nearly six-year federal prison term, the defendant was ordered to pay close to $300,000 in restitution to his victims, concluding a complex, multi-agency cybercrime investigation that crossed international borders and exposed vulnerabilities in major cloud storage and enterprise networks.
Cameron John Wagenius, a 22-year-old active-duty soldier who was stationed at a U.S. Army base in South Korea at the time of his offenses, operated under the cybercriminal moniker “Kiberphant0m.” Working alongside a network of alleged co-conspirators, Wagenius exploited compromised enterprise credentials left exposed in cloud environments. Specifically, the group targeted large corporate customers utilizing the cloud data storage service Snowflake. Because these accounts failed to enforce mandatory multi-factor authentication—a critical security safeguard that Snowflake has since made compulsory across all accounts—the cybercriminals were able to gain unauthorized access and download vast troves of proprietary data.
The extent of the breaches became apparent in October 2024, when Wagenius took to cybercrime forums to boast about his illicit achievements. He claimed responsibility for stealing call and text metadata, including source and destination numbers, timestamps, and call durations, for tens of millions of AT&T customers. Furthermore, Kiberphant0m asserted that he had successfully breached more than a dozen telecommunications companies worldwide, including Verizon’s specialized Push-to-Talk business. Operating as a digital extortionist, he publicly threatened these corporate entities with the mass publication of their stolen proprietary data unless they capitulated to his demands.
The trail that led to his downfall began to form in late November 2024, when cybersecurity publication KrebsOnSecurity published investigative warnings indicating that the hacker operating as Kiberphant0m was likely a U.S. military service member stationed in South Korea. Less than a month after those investigative reports surfaced, Wagenius was apprehended. He was subsequently charged in two separate federal indictments and quickly entered guilty pleas across all counts in both legal cases.
During his sentencing hearing in Seattle, federal authorities delivered the final judgment, cementing the nearly six-year prison sentence and mandating the $294,978 restitution payment. Federal prosecutors detailed how Wagenius did not act entirely in a vacuum, noting that he was assisted in his extortion campaigns by Kenneth Schuchman, a 28-year-old resident of Vancouver, Washington, who possessed an extensive background in cybercrime. Schuchman’s criminal history includes a guilty plea in 2019 for operating the Satori botnet, a massive, weaponized network of compromised Internet-of-Things devices utilized to launch large-scale distributed denial-of-service attacks against critical online infrastructure.
Other alleged co-conspirators tied to the Snowflake data thefts faced parallel legal actions. Conor Riley Moucka, also known as “Judische,” residing in Kitchener, Ontario, was arrested in 2024 and entered a guilty plea in August 2026. Another prominent figure named in the broader investigative landscape is John Erin Binns, an American citizen currently residing in Turkey, who has also been wanted by authorities for his alleged role in a massive 2021 data breach at T-Mobile that exposed the personal information of at least 76 million customers.
As Kiberphant0m’s extortion schemes progressed, the tactics grew increasingly aggressive and erratic. He admitted to engaging in re-extortion tactics against victim companies and even threatened to disclose sensitive national security secrets. Following Moucka’s arrest—and even after AT&T had already paid the extortion syndicate a $370,000 Bitcoin ransom—Kiberphant0m uploaded data to hacker forums that he claimed included call logs belonging to then President-elect Donald Trump and then Vice President Kamala Harris, alongside digital schematics allegedly stolen from the U.S. National Security Agency.
The investigation into Wagenius required a rare and intensive collaboration among multiple federal law enforcement agencies and military investigative arms. Paul Russell, a resident agent in charge at the Defense Criminal Investigative Service, the criminal investigative branch of the U.S. Department of Defense Office of Inspector General, explained that the inquiry intensified rapidly once intelligence indicated an active-duty soldier with a secret security clearance was allegedly trafficking in stolen data and cyber-weapons.
Russell noted the unusual and alarming nature of the case, pointing out that insider threats involving active-duty military personnel with high-level clearances are exceptionally rare. Once the Defense Criminal Investigative Service received the initial leads, the agency joined forces with the Federal Bureau of Investigation, the Army Criminal Investigative Division, and the U.S. Secret Service. The convergence of these powerful investigative bodies underscored the severe national security implications of a cleared soldier engaging in international corporate extortion and data theft.
Even while incarcerated and awaiting sentencing, Wagenius continued to test security boundaries, drawing additional scrutiny from prosecutors. According to a sentencing memo filed by federal prosecutors in Seattle, Wagenius violated the computer use policies of the Bureau of Prisons while behind bars. Investigators discovered that he had attempted to probe the vulnerabilities of the prison system’s internal computer network by routing requests through fellow inmates.
BOP records indicated that in September 2025, Wagenius utilized another inmate’s email system to prompt commercial artificial intelligence tools for specific software vulnerabilities. His queries specifically asked for Common Vulnerabilities and Exposures identifiers related to Windows 10 Enterprise privilege escalation and bypasses, along with requests for real-world working scripts without omitted code. Within a week, he allegedly used another inmate’s email account to solicit step-by-step exploit details and code for a command injection vulnerability found in D-Link networking devices.
Furthermore, records showed Wagenius attempted to research how to construct makeshift prison antennas using commissary items to extend radio reception, alongside inquiries regarding prison escape methods. When confronted with these activities by authorities, Wagenius attempted to downplay his intent, claiming through counsel that he was merely framing the artificial intelligence queries as research for a book he was writing. Prosecutors pointed out that this maneuver reflected a classic prompt injection technique, wherein attackers feed deceptive parameters into commercial AI platforms to bypass built-in safety filters designed to prevent the generation of malicious exploit code. The government confirmed to the court that there was no evidence Wagenius successfully deployed any discovered vulnerabilities against the Bureau of Prisons network.
Despite the massive scale of the corporate data breaches and the immense valuation of the stolen telecommunications metadata, financial records highlighted a stark contrast in the profitability of Wagenius’s criminal enterprise. According to government sentencing documents, despite holding data belonging to over 100 million people, Wagenius earned a meager total of approximately $1,500 from selling the stolen assets. Prosecutors emphasized that while his monetary success as a cybercriminal was exceptionally limited, the actual and intended harm inflicted upon individual citizens, prominent U.S. corporations, and government institutions was profound and widespread.
