Ex-US soldier gets 70 months for role in AT&T, Snowflake data thefts
A former U.S. Army soldier received 70 months for stealing AT&T and Snowflake customer data and extorting victims.
Cameron John Wagenius, 22, a former U.S. Army soldier, was sentenced to 70 months and ordered to pay $294,978 for conspiring to steal data and extort victims. From April 2023 through December 2024, using the alias kiberphant0m, he and others hit at least 10 organizations, including telecom firms and more than 165 Snowflake customers such as AT&T, using stolen logins and a tool called SSH Brute. They threatened leaks on BreachForums and XSS.is, sought at least $1 million, sold some data, and used some for SIM-swapping; prosecutors said he also tried to traffic stolen information to a foreign intelligence service. Co-conspirator Connor Riley Moucka pleaded guilty in August and is due to be sentenced on October 27.
- Wagenius received 70 months and must pay $294,978 restitution.
- The crew stole data from over 165 Snowflake customers, including AT&T.
- They used stolen credentials and SSH Brute, seeking at least $1 million.
- He disclosed call records in November 2024 and allegedly offered data abroad.
- Connor Riley Moucka pleaded guilty; sentencing is scheduled for October 27.
Full article488 words · extracted from helpnetsecurity.com · click to collapse
A former U.S. Army soldier who was part of a group that stole data from telecom companies, including AT&T, has been sentenced to 70 months in prison.
Cameron John Wagenius, 22, was part of the group that hacked Snowflake customer accounts in 2024. They took data from more than 165 organizations that used the US cloud storage company, then threatened to leak it unless the victims paid.
Snowflake is a US-based cloud data storage and analytics company with more than 13,000 customers worldwide.
Wagenius, who was most recently stationed in Texas, was also ordered to pay $294,978 in restitution. He conspired to hack into telecommunications companies’ databases, access sensitive records, and extort the companies by threatening to release the stolen data unless they paid a ransom.
“Cameron Wagenius spent more than a year and a half betraying the trust placed in him as an active duty soldier by carrying out a sweeping cybercrime campaign,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “He targeted U.S. and foreign telecommunications companies, compromised the sensitive data of countless people, and even sought to traffic stolen information to a foreign intelligence service.”
According to court documents, between April 2023 and December 18, 2024, Wagenius used online accounts associated with the nickname “kiberphant0m” and conspired with others to defraud at least 10 victim organizations.
The group obtained login credentials for the organizations’ protected computer networks, in part by using a hacking tool called SSH Brute that Wagenius helped develop. They used Telegram group chats to share stolen credentials and discuss how to get into victim companies’ networks.
Wagenius did all this while he was on active duty with the U.S. Army.
After stealing the data, Wagenius and his co-conspirators extorted the victim organizations both privately and in public forums. They threatened to post the data on cybercrime forums such as BreachForums and XSS.is, and in other cases offered to sell it for thousands of dollars.
They sold at least some of the stolen data and used some of it for other frauds, including SIM-swapping. In total, they tried to extort at least $1 million from the victims.
“It is especially shocking that a member of our armed forces, sworn to defend Americans and their Constitutional rights, would engage in such a violation of privacy,” noted Special Agent in Charge W. Mike Herrington of the FBI Seattle field office.
In November 2024, Wagenius published two online posts that disclosed stolen call detail records belonging to a government official and to family members of another former official. The records showed information about calls, without their content. He threatened to release more records unless he was paid.
The text of one post suggested he was acting in retaliation for the then-recent arrest of another cybercriminal.
Another hacker responsible for the Snowflake breaches, Connor Riley Moucka of Canada, pleaded guilty in August and is due to be sentenced on October 27.