A Canadian man pleaded guilty today to his role in accessing company accounts at cloud storage provider Snowflake and stealing data from at least 165 organizations in a scheme to extort millions of dollars from victims.
26-year-old Connor Riley Moucka, also known as Alexander Moucka and Waifu, was arrested on October 30, 2024, for stealing data of hundreds of millions of individuals from companies using Snowflake’s storage service.
Between February and October 2024, Moucka and John Erin Binns, also indicted for these attacks, accessed Snowflake accounts not protected by multi-factor authentication (MFA) using logins stolen via infostealer malware.
Without MFA enabled, the threat actor needed only the correct usernames and passwords to log into customer accounts.
According to court documents, the unauthorized access was used to identify valuable information (e.g., organization name, user roles, IP addresses) in cloud storage instances using custom software.
Moucka and Binn tried to extort multiple companies after stealing terabytes of data from their Snowflake tenant environments and obtained at least $2.5 million in bitcoin from at least three victims.
The following information was stolen from the breached accounts:
They also advertised on various hacker forums to sell the information for fiat currency or cryptocurrency, and Moucka obtained at least $ 495,000 this way.
In a press release today, the U.S. Department of Justice says that “in at least one instance, Moucka re-extorted a victim with threats of further disclosure of the victim’s stolen data.”
“Moucka used the stolen data of a government officer and members of a then-former government officer’s immediate family in this re-extortion attempt.”
The DoJ says that victim companies suffered more than $9.5 million in losses and more than 100 million individuals have been affected by the Snowflake attacks.
Moucka pleaded guilty to four counts of the indictment (computer fraud, wire fraud, aggravated identity theft, and a related conspiracy) and is scheduled for sentencing on October 27.
He faces a maximum sentence of 32 years in prison.
At the time of the attacks, Binns resided in Turkey, where he was arrested. A local court approved an extradition request from U.S. prosecutors but it was contested.
The list of impacted companies includes AT&T, Ticketmaster, Santander, Pure Storage, Advance Auto Parts, Los Angeles Unified, QuoteWizard/LendingTree, and Neiman Marcus.
Following these data breaches, Snowflake announced it would enforce MFA protection and require all passwords to be at least 14 characters long.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Ernst & Young data breach claimed by ShinyHunters extortion gang
Lidl discloses online shop breach after service provider hack
Insurance giant Aflac discloses data breach after subsidiary hack
NAIC says public data stolen in ShinyHunters’ PeopleSoft breach
Kodak confirms data breach claimed by ShinyHunters extortion gang
Hotel Wi-Fi attacks use custom malware to breach Microsoft 365 accounts
Massive ChainDrop npm supply-chain attack infects hundreds of packages
New Pass-ta-key attacks let malware hijack Google-synced passkeys
Spend four hours inside a fully-simulated underground with DARKROOM.
Webinar: Shadow AI in 2026 (and how attackers are taking advantage)
AI is a data-breach time bomb: Read the new report
Explore ESET’s H1 2026 Threat Report to uncover the latest AI, phishing, and ransomware trends.
Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday.
Terms of Use – Privacy Policy – Ethics Statement – Affiliate Disclosure
Read our posting guidelinese to learn what content is prohibited.
