A Canadian who helped orchestrate the sprawling Snowflake-linked data theft campaign has pleaded guilty in the US, admitting that he and his co-conspirators returned to squeeze at least one victim a second time. Connor Riley Moucka, 26, of Kitchener, Ontario, admitted computer fraud, wire fraud, aggravated identity theft, and conspiracy charges over a hacking spree that compromised more than 165 organizations, exposed billions of customer records, and brought in about $2.5 million in ransom payments. According to the US Department of Justice, Moucka and his co-conspirators used stolen login credentials to break into the cloud environments of at least 165 customers of a US software provider between February and October 2024. The DOJ still doesn't name the company, but the allegations match the 2024 campaign against Snowflake customers that ensnared the likes of Ticketmaster, Santander, AT&T, and dozens of others. In a plea agreement seen by The Register, Moucka admitted developing software that automatically searched compromised cloud environments for valuable information. He and his co-conspirators used it to identify lucrative targets and steal terabytes of banking records, payroll data, passport and driver's license numbers, Social Security numbers, DEA registration numbers, and other sensitive information. They then threatened to publish the haul unless victims paid up. Moucka also admitted that the conspirators returned to at least one victim after it paid a ransom in May 2024, demanding more money months later to prevent the stolen customer data from being published or sold. The second attempt used stolen records concerning a government official and members of a former government official's immediate family. The stolen data was also advertised for sale on cybercrime forums including BreachForums, Exploit.in, and XSS.is, as well as via Telegram, according to prosecutors. The group demanded at least $6 million from its victims and received about 36 Bitcoin, then worth roughly $2.5 million. Moucka admitted pocketing at least $495,000. Victim organizations suffered more than $9.5 million in direct losses, though the DOJ said that figure does not include downstream harm affecting at least 100 million individuals whose personal information was exposed. Moucka was arrested in Canada in October 2024, just months after investigators linked him to the attacks, and was extradited to the US in July this year. He is due to be sentenced on October 27. Aggravated identity theft carries a mandatory two-year prison term that must run consecutively to any other sentence, while the other offences carry varying maximum penalties. A federal judge will determine Moucka's sentence. ®
