Hacker pleads guilty to breaching 165 Snowflake clients and stealing billions of records

Connor Moucka, a 26-year-old Canadian citizen, has pleaded guilty to hacking more than 165 companies, stealing billions of records, and extorting several businesses and individuals. The U.S. Department of Justice announced the plea on Wednesday.

Moucka targeted cloud provider Snowflake, which let him and his accomplices break into dozens of the company's customers, including AT&T, LendingTree, and Ticketmaster. From AT&T, he stole data belonging to over 100 million subscribers — call and text logs, plus banking details, driver's license numbers, and Social Security numbers from other breaches.

Over the course of their activities, Moucka and his co-conspirators collected more than $2.5 million in ransom payments. The hacker also earned around $500,000 by selling victims' data on forums such as the notorious BreachForums. The DOJ estimates the total losses from their attacks at $9.5 million.

FBI special agent W. Mike Herrington, who worked on the case, described Moucka's threats and re-extortion tactics as calculated and predatory, stressing that his actions caused real harm to both the companies targeted and the millions of ordinary people who are their customers.

Moucka, known online as Waifu and Judische, was arrested in Canada at the end of 2024, just months after the Snowflake breaches. At the time, Austin Larsen, a senior researcher at Google's cybersecurity firm Mandiant who investigated the hacks, called Moucka one of the most consequential hackers of 2024.

Sentencing is scheduled for October 27. Moucka faces decades in prison.