Canadian Hacker Pleads Guilty to Massive Data Theft and Extortion Scheme
A 26-year-old Canadian national, Connor Moucka, has pleaded guilty to hacking over 165 companies, stealing billions of records, and extorting victims for millions. The U.S. Department of Justice (DOJ) announced the guilty plea on Wednesday, detailing Moucka’s role in a series of high-profile cyberattacks.
Moucka, operating under the aliases Waifu and Judische, targeted cloud provider Snowflake, exploiting vulnerabilities to breach dozens of its customers, including AT&T, LendingTree, and Ticketmaster. The attack on AT&T alone compromised data from over 100 million customers, including call records, banking details, driver’s license numbers, and Social Security numbers. Other breaches exposed similarly sensitive information.
Over several years, Moucka and his co-conspirators extorted victims for more than $2.5 million in ransom payments and earned an additional $500,000 by selling stolen data on hacking forums like BreachForums. The DOJ estimates the total financial impact on victims at $9.5 million.
FBI Special Agent W. Mike Herrington described Moucka’s tactics as "calculated and predatory," emphasizing the real-world harm inflicted on both corporations and their customers. Arrested in Canada in late 2024, Moucka was identified by cybersecurity researchers, including Google’s Mandiant, as one of the most consequential hackers of the year.
Moucka is scheduled to be sentenced on October 27 and faces decades in prison.
Snowflake cybersecurity rating report: https://www.rankiteo.com/company/snowflake-computing
Ticketmaster cybersecurity rating report: https://www.rankiteo.com/company/ticketmaster
AT&T cybersecurity rating report: https://www.rankiteo.com/company/att
LendingTree cybersecurity rating report: https://www.rankiteo.com/company/lendingtree
"id": "SNOTICATTLEN1786041634",
"linkid": "snowflake-computing, ticketmaster, att, lendingtree",
"type": "Vulnerability",
"date": "5/2024",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Over 100 million',
'industry': 'Telecommunications',
'name': 'AT&T',
'type': 'Telecommunications'},
{'industry': 'Finance',
'name': 'LendingTree',
'type': 'Financial Services'},
{'industry': 'Ticketing',
'name': 'Ticketmaster',
'type': 'Entertainment'},
{'customers_affected': 'Dozens of customers',
'industry': 'Technology',
'name': 'Snowflake',
'type': 'Cloud Provider'}],
'attack_vector': 'Exploiting vulnerabilities in cloud provider (Snowflake)',
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': 'Billions',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Call records',
'Banking details',
'Driver’s license numbers',
'Social Security numbers']},
'description': 'A 26-year-old Canadian national, Connor Moucka, has pleaded '
'guilty to hacking over 165 companies, stealing billions of '
'records, and extorting victims for millions. The attack '
'exploited vulnerabilities in cloud provider Snowflake to '
'breach dozens of its customers, including AT&T, LendingTree, '
'and Ticketmaster. Moucka and his co-conspirators extorted '
'victims for over $2.5 million in ransom payments and earned '
'an additional $500,000 by selling stolen data on hacking '
'forums.',
'impact': {'brand_reputation_impact': 'High',
'data_compromised': 'Billions of records',
'financial_loss': '$9.5 million',
'identity_theft_risk': 'High',
'payment_information_risk': 'High',
'systems_affected': 'Cloud provider (Snowflake) and its customers'},
'initial_access_broker': {'data_sold_on_dark_web': 'Yes (BreachForums)',
'entry_point': 'Cloud provider (Snowflake) '
'vulnerabilities'},
'investigation_status': 'Guilty plea entered',
'motivation': ['Financial gain', 'Data extortion'],
'post_incident_analysis': {'root_causes': 'Exploitation of cloud provider '
'vulnerabilities'},
'ransomware': {'data_exfiltration': 'Yes', 'ransom_paid': '$2.5 million'},
'references': [{'source': 'U.S. Department of Justice (DOJ)'},
{'source': 'Google’s Mandiant'}],
'regulatory_compliance': {'legal_actions': 'Criminal prosecution (U.S. DOJ)'},
'response': {'law_enforcement_notified': 'Yes (FBI, DOJ)',
'third_party_assistance': 'Google’s Mandiant'},
'threat_actor': 'Connor Moucka (aliases: Waifu, Judische)',
'title': 'Canadian Hacker Pleads Guilty to Massive Data Theft and Extortion '
'Scheme',
'type': 'Data Theft and Extortion',
'vulnerability_exploited': 'Cloud provider vulnerabilities'}