Connor Moucka pleads guilty to Snowflake data theft, faces 32 years
This digest was compiled by AI from multiple sources — links to the originals are below.
Connor Riley Moucka pleaded guilty today to his role in accessing cloud storage provider Snowflake and stealing data from at least 165 organizations. The 26‑year‑old Canadian faces up to 32 years in prison after conspiring to extort millions of dollars from victims. The breaches exposed over 100 million individuals and prompted Snowflake to mandate multi‑factor authentication.
The Intrusion Method
Between February and October 2024, Moucka and co‑conspirator John Binns used credentials stolen via infostealer malware to log into Snowflake customer accounts that lacked multi‑factor authentication. They scanned cloud storage instances with custom tools, identifying valuable data such as call and text records, financial and payroll information, DEA registration numbers, driver’s licenses, passports, and Social Security numbers. At least 165 organizations were breached, among them AT&T, Ticketmaster, Santander, and Neiman Marcus.
The Extortion Scheme
After stealing terabytes of data, Moucka and Binns attempted to extort victim companies, demanding ransom payments. They obtained at least $2.5 million in bitcoin from at least three victims, and Moucka separately sold stolen data on hacker forums for an additional $495,000. The U.S. Justice Department noted that in at least one instance Moucka re‑extorted a victim by threatening to disclose the data of a government officer and their family.
Legal Consequences
Moucka pleaded guilty to computer fraud, wire fraud, aggravated identity theft, and conspiracy. Sentencing is set for October 27, where he faces a maximum of 32 years in prison. Co‑defendant Binns was arrested in Turkey; an extradition request has been approved but is being contested. The attacks caused over $9.5 million in losses and affected more than 100 million individuals. Following the breaches, Snowflake mandated multi‑factor authentication and a 14‑character minimum password length.
What's Next
Moucka’s sentencing is scheduled for October 27, when a federal judge will determine his prison term. It remains unclear whether Binns will be extradited to the U.S. to face trial.
6 sources
Connor Moucka pleads guilty to Snowflake data theft, faces 32 years
