Canadian pleads guilty to Snowflake cloud data-theft attacks

Summary

Connor Riley Moucka, also known as Waifu, has pleaded guilty to accessing over 165 Snowflake accounts using stolen credentials from infostealer malware. He exploited the lack of MFA to steal terabytes of sensitive data, extorting millions from victims and selling data on hacker forums. The attacks impacted over 100 million individuals and caused over $9.5 million in losses.

Full text

Canadian pleads guilty to Snowflake cloud data-theft attacks By Ionut Ilascu August 5, 2026 05:53 PM 0 A Canadian man pleaded guilty today to his role in accessing company accounts at cloud storage provider Snowflake and stealing data from at least 165 organizations in a scheme to extort millions of dollars from victims. ​26-year-old Connor Riley Moucka, also known as Alexander Moucka and Waifu, was arrested on October 30, 2024, for stealing data of hundreds of millions of individuals from companies using Snowflake’s storage service. Between February and October 2024, Moucka and John Erin Binns, also indicted for these attacks, accessed Snowflake accounts not protected by multi-factor authentication (MFA) using logins stolen via infostealer malware. Without MFA enabled, the threat actor needed only the correct usernames and passwords to log into customer accounts. According to court documents, the unauthorized access was used to identify valuable information (e.g., organization name, user roles, IP addresses) in cloud storage instances using custom software. Moucka and Binn tried to extort multiple companies after stealing terabytes of data from their Snowflake tenant environments and obtained at least $2.5 million in bitcoin from at least three victims. The following information was stolen from the breached accounts: Call and text history records (non-content) Banking and financial information Payroll records Drug Enforcement Administration (DEA) registration numbers Driver’s license numbers Passport numbers Social Security numbers Other personally identifiable information (PII) They also advertised on various hacker forums to sell the information for fiat currency or cryptocurrency, and Moucka obtained at least $ 495,000 this way. In a press release today, the U.S. Department of Justice says that “in at least one instance, Moucka re-extorted a victim with threats of further disclosure of the victim’s stolen data.” “Moucka used the stolen data of a government officer and members of a then-former government officer’s immediate family in this re-extortion attempt.” The DoJ says that victim companies suffered more than $9.5 million in losses and more than 100 million individuals have been affected by the Snowflake attacks. Moucka pleaded guilty to four counts of the indictment (computer fraud, wire fraud, aggravated identity theft, and a related conspiracy) and is scheduled for sentencing on October 27. He faces a maximum sentence of 32 years in prison. At the time of the attacks, Binns resided in Turkey, where he was arrested. A local court approved an extradition request from U.S. prosecutors but it was contested. The list of impacted companies includes AT&T, Ticketmaster, Santander, Pure Storage, Advance Auto Parts, Los Angeles Unified, QuoteWizard/LendingTree, and Neiman Marcus. Following these data breaches, Snowflake announced it would enforce MFA protection and require all passwords to be at least 14 characters long. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: Ernst & Young data breach claimed by ShinyHunters extortion gangLidl discloses online shop breach after service provider hackInsurance giant Aflac discloses data breach after subsidiary hackNAIC says public data stolen in ShinyHunters' PeopleSoft breachKodak confirms data breach claimed by ShinyHunters extortion gang

Indicators of Compromise

• malware — infostealer malware

Entities