Canadian Man Pleads Guilty in Snowflake Cloud Extortion Campaign Affecting 100+ Million People
A 26-year-old Canadian man, Connor Riley Moucka (also known online as Alexander Moucka and “Waifu”), has pleaded guilty in US federal court to hacking customer accounts at cloud data platform Snowflake and extorting the affected companies. Moucka was arrested in Canada in October 2024. Prosecutors say that between February and October 2024, he and co-defendant John Erin Binns broke into Snowflake tenant accounts that lacked multi-factor authentication, using login credentials obtained through infostealer malware, then used custom tools to identify and exfiltrate valuable data from those accounts.
The Department of Justice says the campaign ultimately affected more than 100 million individuals and caused victim companies over $9.5 million in losses. Stolen data reportedly included call and text records, banking and payroll information, driver’s license and passport numbers, Social Security numbers, and other personal data. The pair extorted at least three victims for a combined $2.5 million in bitcoin and separately sold stolen records on hacking forums for roughly $495,000. In one case described by prosecutors, Moucka allegedly “re-extorted” a victim using stolen data belonging to a government official and their family members, threatening further disclosure.
The companies whose Snowflake-hosted data was affected span multiple industries and include AT&T, Ticketmaster, Santander, Advance Auto Parts, Los Angeles Unified School District, and Neiman Marcus, among others — making this one of the broadest cloud-platform extortion campaigns publicly documented in recent years. Snowflake responded to the incidents by mandating multi-factor authentication and minimum password-length requirements across its customer base.
Moucka pleaded guilty to four counts, including computer fraud, wire fraud, and aggravated identity theft, and faces a maximum sentence of 32 years in prison when sentenced on October 27. Binns, who was arrested in Turkey, remains subject to a contested US extradition request.