Army soldier who extorted AT&T using Snowflake logins without MFA gets 70 months
Army soldier Cameron Wagenius got 70 months in prison for extorting AT&T with call records taken from Snowflake accounts that lacked MFA. His group got in with exposed credentials alone, and AT&T's $370,000 ransom did not stop the leaks that followed.
The Watch · Security desk
What happened
- Cameron Wagenius, 22, was sentenced in Seattle to 70 months in federal prison and ordered to pay $294,978 in restitution.
- He and three alleged co-conspirators downloaded data from large Snowflake customers that had exposed credentials and did not enforce multi-factor authentication.
- Prosecutors say Wagenius, Moucka and Binns stole billions of records and took in more than $2.5 million in extortion payments from victims including AT&T, Ticketmaster and Santander.
- After AT&T paid a $370,000 Bitcoin ransom, Wagenius posted what he claimed were AT&T call logs for Donald Trump and Kamala Harris.
Why it matters
- Who's exposed exposure Tenants on any hosted data platform that still allows password-only logins face the same method, since this campaign needed exposed credentials and no software flaw.
- What it costs cost AT&T's payment bought no lasting silence; the group leaked records afterward and Wagenius admitted re-extorting victims.
- What it sets up precedent With Moucka and Binns unsentenced, 70 months for a quick, cooperative guilty plea is the first marker of what the remaining Snowflake defendants face.
Next story · Invest · 2d ago
AT&T recovers 45% of its roughly $4.4 billion Mexico outlay in a $2 billion saleConfirmed3 publishers
Both accounts describe the intrusions as logins. Prosecutors, as CyberScoop reports, say Wagenius and Moucka tried to extort more than 10 organizations after stealing credentials and breaking into the cloud platforms those companies used [3]. Officials said Wagenius stole credentials with SSH Brute, a tool he helped develop, while on active duty [2]. The sources do not say how the Snowflake credentials were first exposed [15]. On a Snowflake tenant, the control that decided whether a stolen password was enough was the customer's own MFA setting [15]. Snowflake has since made MFA mandatory on all accounts [16].
AT&T confirmed in July that attackers entered its Snowflake environment in April and took six months of call and text records for "nearly all" of its customers [5]. Krebs puts the count at more than 100 million [6]. Conor Riley Moucka, a co-defendant, pleaded guilty in August to a central role in compromising more than 165 Snowflake customer environments [4].
Along with the claimed Trump and Harris call logs, Kiberphant0m posted schematics he said were stolen from the NSA [8]. Allison Nixon, chief research officer at Unit 221B, told CyberScoop the Trump records came out during failed attempts to extort $500,000 from AT&T [10]. Wagenius admitted re-extorting victims and threatening to disclose national security secrets [9].
The insider in this case was inside the Army. The reporting does not place him inside AT&T, Snowflake or any other victim; he reached them with stolen credentials [13][3]. For teams on cloud data platforms, these filings support a lesson about credentials and MFA enforcement. Paul Russell, a supervisory special agent with the Defense Criminal Investigative Service, said his agency joined the FBI, Army CID and Secret Service on the case after learning a soldier with a secret clearance was allegedly involved [13]. "We don't often get leads where there's an active duty soldier with a secret clearance who's creating hacking tools and trafficking in data," Russell said, adding that "it was an insider threat, and we weren't sure what we were dealing with" [12]. Before his December 2024 arrest, Wagenius tried to sell stolen data to a foreign intelligence service and looked into defecting to Russia, CyberScoop reports [14].
Some of the people around him have earlier cases. Prosecutors said Kenneth Schuchman, who pleaded guilty in 2019 to running the Satori IoT botnet, helped Wagenius extort victims [21]. John Erin Binns, an American living in Turkey, is also wanted over the 2021 T-Mobile breach that exposed personal data of at least 76 million customers [11].
Prosecutors' Sept. 19 sentencing memo says that around September 2025, while jailed awaiting sentencing, Wagenius used another inmate's email to ask that a commercial AI tool be prompted for "[w]hat CVE's are there for Windows 10 Enterprise privilege escalation and bypasses" [20]. "His hacking schemes were not only aimed at getting rich, he was also motivated by a desire to achieve status within criminal hacking communities," Charles Neil Floyd, first assistant attorney in the Western District of Washington, said in a statement [24].
Krebs has Wagenius stationed in South Korea when he took up the Kiberphant0m name [17]. CyberScoop has him on active duty in Texas, and says that after agents seized his devices in December 2024 he bought a new laptop against his commanding officer's order and used it in the Fort Cavazos barracks behind a VPN [18]. Krebs dates its own warning about him to late November 2025, with the arrest less than a month later [25]. That conflicts with the December 2024 seizure and the September 2025 prison records [18][20]. Seventy months is five years and ten months [23]. Krebs describes the term as "nearly seven years" [19].
What to watch
- Moucka's sentencing, after his guilty plea to a central role in compromising more than 165 Snowflake customer environments.
- Any move to bring Binns, who lives in Turkey and is not in U.S. custody, before a U.S. court on the Snowflake and 2021 T-Mobile cases.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence82
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence78
Perspective Coverage
7 publishers- Builder
- Builder 22%
- Operator
- Operator 59%
- Investor
- Investor 19%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Cameron John Wagenius, 22, was sentenced at a hearing in Seattle to 70 months in federal prison and ordered to pay $294,978 in restitution.
- [2]
Officials said Wagenius used a hacking tool he helped develop called SSH Brute to steal credentials while on active duty.
- [3]
Wagenius and co-conspirator Moucka attempted to extort more than 10 organizations after stealing credentials and breaking into cloud platforms used by AT&T and other major companies in the U.S. and abroad.
- [4]
Moucka pleaded guilty in August to playing a central role in the compromise of more than 165 Snowflake customer environments.
- [5]
AT&T in July confirmed cybercriminals accessed the company's Snowflake environment in April and stole six months of phone and text records of "nearly all" of its customers.
- [6]
The stolen mobile call and text metadata covered more than 100 million AT&T customers in 2024.
- [7]
According to prosecutors, Wagenius, Moucka and Binns stole billions of sensitive records and received more than $2.5 million in extortion payments combined; victims included AT&T, Ticketmaster, Advance Auto Parts and Santander.
- [8]
After AT&T had already paid the extortion group a $370,000 Bitcoin ransom, and immediately following Moucka's arrest, Kiberphant0m posted what he claimed were AT&T call logs for then President-elect Donald Trump and then Vice President Kamala Harris, plus schematics allegedly stolen from the NSA.
- [9]
Kiberphant0m admitted to re-extorting victims and threatening to disclose national security secrets.
- [10]
Allison Nixon, chief research officer at Unit 221B, previously told CyberScoop that Wagenius leaked stolen call records of Donald Trump as part of multiple failed attempts to extort $500,000 from AT&T.
- [11]
John Erin Binns, an American living in Turkey, is still facing charges in the Snowflake thefts and is also wanted for a 2021 T-Mobile breach that exposed personal information of at least 76 million customers.
- [12]
"We don't often get leads where there's an active duty soldier with a secret clearance who's creating hacking tools and trafficking in data," Russell said. "That doesn't happen every day, and so when that hits it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren't sure what we were dealing with."
- [13]
Paul Russell, a supervisory special agent with DCIS, said that when DCIS received information that a soldier with secret clearance was allegedly involved in cybercrime and extortion, it began working the investigation with the FBI, Army CID and the U.S. Secret Service.
- [14]
Prior to his arrest in December 2024, Wagenius attempted to sell stolen sensitive data to a foreign intelligence service and sought information online about defecting to Russia.
- [15]
Working as Kiberphant0m with three alleged co-conspirators, Wagenius downloaded data from several large customers of Snowflake that had exposed credentials and did not enforce multi-factor authentication.
- [16]
Snowflake has since mandated MFA on all accounts.
- [17]
Wagenius was stationed at a U.S. Army base in South Korea when he adopted the Kiberphant0m persona.
- [18]
Wagenius was on active duty on a base in Texas; after federal agents seized his devices in December 2024, he bought a new laptop against his commanding officer's order and used it daily over five days in the Fort Cavazos barracks with VPN software.
- [19]
KrebsOnSecurity describes the sentence as nearly seven years in federal prison.
- [20]
A sentencing memo filed Sept. 19 says that in or around September 2025, while incarcerated awaiting sentencing, Wagenius used another inmate's email system to request that the recipient prompt a commercial AI tool about "[w]hat CVE's are there for Windows 10 Enterprise privilege escalation and bypasses".
- [21]
Federal prosecutors said Kenneth Schuchman, 28, of Vancouver, Washington, assisted Wagenius in extorting victim companies; Schuchman pleaded guilty in 2019 to operating the Satori IoT botnet.
- [22]
The sentencing memo notes Wagenius pleaded guilty almost immediately and has been remarkably cooperative.
- [23]
A 70-month sentence is five years and ten months.
- [24]
"His hacking schemes were not only aimed at getting rich, he was also motivated by a desire to achieve status within criminal hacking communities," Charles Neil Floyd, first assistant attorney for the Western District of Washington, said in a statement.
- [25]
KrebsOnSecurity says it warned in late November 2025 that Kiberphant0m was likely a U.S. soldier in South Korea, and that Wagenius was arrested less than a month later.
Sources
7 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comUS soldier gets 70 months in prison for extorting 10 tech, telecom firms
1 article · September 28, 2026
- cyberscoop.comArmy soldier sentenced for spree of attacks on AT&T, Snowflake and other major companies | CyberScoop
2 articles · September 25, 2026
- helpnetsecurity.comEx-US soldier gets 70 months for role in AT&T, Snowflake data thefts
1 article · September 28, 2026
- krebsonsecurity.comU.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
2 articles · September 25, 2026
- scworld.comUS soldier sentenced to 70 months for hacking AT&T data
1 article · September 28, 2026
- securityweek.comPrison Sentence for Former US Soldier Who Hacked AT&T and Verizon
1 article · September 28, 2026
- therecord.mediaFormer US soldier gets nearly six-year sentence for hacking, extorting telecoms
1 article · September 28, 2026
Topics and entities
Topics
- Cloud data breaches
- Cyber Extortion
- Insider Threat
- Multi-Factor Authentication
Entities
- Snowflake
- Defense Criminal Investigative Service
- AT&T
- KrebsOnSecurity
- Kenneth Schuchman
- Cameron John Wagenius
- Connor Riley Moucka