The Scope of the Breach

165 organizations that used Snowflake's cloud storage platform were compromised . Importantly, no Snowflake vulnerability was exploited — the attackers used stolen customer login credentials against accounts that lacked multi-factor authentication (MFA) .

Data belonging to at least 100 million people was taken . The theft included call and texting records of more than 100 million AT&T customers and customer data and payment information from over 560 million Ticketmaster accounts . Other major victims included Advance Auto Parts, LendingTree, Neiman Marcus, Santander, Anheuser-Busch, Allstate, Mitsubishi, Progressive, and State Farm .

Types of Stolen Data

The stolen information included:

• Call and text history records (dialed numbers, timestamps, call durations — not content of the communications)
• Banking information, payroll records
• Social Security numbers, driver's license numbers, passport numbers
• Drug Enforcement Administration (DEA) registration numbers
• Customer records, payment data, and other "extremely sensitive information"

The group downloaded billions of sensitive customer records amounting to terabytes of data .

Ransom, Extortion Payments, and Financial Losses

• Moucka's personal take: He personally earned at least $495,000 from extorting victims and selling stolen data on hacking forums . In one case, he re-extorted a victim using stolen data of a government official and members of a former government official's immediate family .
• Total scheme revenue: Moucka and his co-conspirators (including John Erin Binns and Cameron John Wagenius) generated a total of approximately $2.5 million from extortion payments and data sales .
• Victim company losses: Victim organizations collectively reported over $9.5 million in direct losses, a figure that excludes losses to their own customers .
• Method: The group would steal data, then threaten to publish or sell it unless ransoms were paid. At least one victim was extorted a second time after the first payment .

Potential Sentencing

• Moucka faces a maximum of up to 32 years in federal prison . This includes a mandatory minimum of two years for aggravated identity theft .
• Sentencing has not yet been scheduled as of August 2026. As part of the plea deal, Moucka agreed to forfeit assets including cryptocurrency wallets and computer equipment used in the crimes .
• Moucka was arrested in Kitchener, Ontario in October 2024 and extradited to the United States in July 2025 .

Key Takeaway: A Story About Stolen Passwords, Not Zero-Days

A critical detail that prosecutors and security experts have repeatedly emphasized: no Snowflake system vulnerability was ever exploited . The entire campaign relied on stolen login credentials used against Snowflake accounts that did not have multi-factor authentication enabled . Google's Mandiant investigators, who tracked the group as UNC5537, described it as "one of the most consequential credential-theft campaigns in cloud security history" .

The case serves as a stark reminder for organizations: even the most secure cloud platform is only as safe as the login credentials protecting each customer's tenant.

The Scope of the Breach

165 organizations that used Snowflake's cloud storage platform were compromised . Importantly, no Snowflake vulnerability was exploited — the attackers used stolen customer login credentials against accounts that lacked multi-factor authentication (MFA) .

Data belonging to at least 100 million people was taken . The theft included call and texting records of more than 100 million AT&T customers and customer data and payment information from over 560 million Ticketmaster accounts . Other major victims included Advance Auto Parts, LendingTree, Neiman Marcus, Santander, Anheuser-Busch, Allstate, Mitsubishi, Progressive, and State Farm .

Types of Stolen Data

The stolen information included:

• Call and text history records (dialed numbers, timestamps, call durations — not content of the communications)
• Banking information, payroll records
• Social Security numbers, driver's license numbers, passport numbers
• Drug Enforcement Administration (DEA) registration numbers
• Customer records, payment data, and other "extremely sensitive information"

The group downloaded billions of sensitive customer records amounting to terabytes of data .

Ransom, Extortion Payments, and Financial Losses

• Moucka's personal take: He personally earned at least $495,000 from extorting victims and selling stolen data on hacking forums . In one case, he re-extorted a victim using stolen data of a government official and members of a former government official's immediate family .
• Total scheme revenue: Moucka and his co-conspirators (including John Erin Binns and Cameron John Wagenius) generated a total of approximately $2.5 million from extortion payments and data sales .
• Victim company losses: Victim organizations collectively reported over $9.5 million in direct losses, a figure that excludes losses to their own customers .
• Method: The group would steal data, then threaten to publish or sell it unless ransoms were paid. At least one victim was extorted a second time after the first payment .

Potential Sentencing

• Moucka faces a maximum of up to 32 years in federal prison . This includes a mandatory minimum of two years for aggravated identity theft .
• Sentencing has not yet been scheduled as of August 2026. As part of the plea deal, Moucka agreed to forfeit assets including cryptocurrency wallets and computer equipment used in the crimes .
• Moucka was arrested in Kitchener, Ontario in October 2024 and extradited to the United States in July 2025 .

Key Takeaway: A Story About Stolen Passwords, Not Zero-Days

A critical detail that prosecutors and security experts have repeatedly emphasized: no Snowflake system vulnerability was ever exploited . The entire campaign relied on stolen login credentials used against Snowflake accounts that did not have multi-factor authentication enabled . Google's Mandiant investigators, who tracked the group as UNC5537, described it as "one of the most consequential credential-theft campaigns in cloud security history" .

The case serves as a stark reminder for organizations: even the most secure cloud platform is only as safe as the login credentials protecting each customer's tenant.