Canadian Hacker Admits to Snowflake Data Breach That Hit 165 Companies and 100 Million People

Connor Riley Moucka, a 26-year-old from Kitchener, Ontario, pleaded guilty on August 5, 2026, to four federal charges in U.S. District Court for the Western District of Washington: computer fraud, wire fraud, aggravated identity theft, and conspiracy . His sentencing is scheduled for October 27, 2026, where he faces a maximum of 32 years in prison .

Moucka's plea closes the U.S. case against one of the central figures in the 2024 Snowflake hacking spree, described by the FBI as a sophisticated cybercriminal who believed he could operate anonymously but was tracked down within six months .

The Scale of the Breach: 165 Companies and Billions of Records

According to the U.S. Department of Justice, between February and October 2024, Moucka and his co-conspirators used stolen login credentials obtained from infostealer malware to access the cloud-hosted data of at least 165 organizations that were customers of Snowflake, a major U.S.-based cloud data storage provider .

The campaign specifically targeted Snowflake accounts that were not protected by multi-factor authentication (MFA) . Once inside, Moucka downloaded terabytes of data, stealing billions of sensitive customer records . The breach exposed the personal records of at least 100 million individuals .

What Data Was Stolen from AT&T and Other Victims?

Victims included some of the largest companies in North America: AT&T, Ticketmaster (Live Nation), LendingTree, Advance Auto Parts, and the Neiman Marcus Group .

For AT&T alone, Moucka admitted to stealing the call and text history records of more than 100 million customers . In other breaches, the stolen data included banking information, driver's license numbers, and Social Security numbers . The total haul encompassed approximately 50 billion call and text records across all victims .

How Much Money Did Moucka Make?

The financial details of the crime are stark. Moucka earned approximately $495,000 from his crimes through a combination of extortion payments and selling stolen data on BreachForums .

While his personal take was under half a million dollars, the damage to victim companies was far greater. Businesses reported over $9.5 million in direct losses related to the breaches . In a particularly aggressive tactic, Moucka and his co-conspirators returned to extort at least one victim a second time, using stolen data from a government official's family to increase pressure .

Online Aliases and Arrest

Moucka operated under multiple online aliases, including Alexander Moucka, Waifu, and Judische . He was arrested on October 30, 2024, by Canadian authorities at his home in Kitchener, Ontario, on a provisional arrest warrant for extradition to the United States . After consenting to extradition, he was transferred to U.S. custody in July 2025 .

FBI Characterization

The FBI and the Justice Department described Moucka's operation as a widespread hacking conspiracy involving the theft of "extremely sensitive information" and extortion demands for millions of dollars. An FBI assistant director issued a pointed statement: "Hiding behind a screen is no shield from justice" .

Sentencing and Co-Conspirators

Moucka is scheduled to be sentenced on October 27, 2026 . He faces a mandatory minimum of two years for the aggravated identity theft count, with the other charges carrying up to 30 additional years, for a total maximum of 32 years .

The case also names co-conspirators John Edward Binns (also known as irdev) and Cameron John Wagenius, who remain separate defendants in the ongoing investigation .