Connor Moucka, a 26-year-old Canadian citizen, has pleaded guilty to hacking more than 165 companies, stealing billions of records and extorting businesses and individuals, the U.S. Department of Justice announced Wednesday.
Moucka and his co-conspirators targeted cloud provider Snowflake and used compromised accounts to access dozens of its customers, including AT&T, LendingTree and Ticketmaster. The hackers stole data belonging to more than 100 million AT&T customers, including call and text records, along with sensitive financial and personal information from other victims.
The group collected more than $2.5 million in ransom payments and earned another $500,000 by selling stolen data on hacking forums such as BreachForums. The DOJ estimates that victims suffered about $9.5 million in losses.
“Connor Moucka’s threats and re-extortion tactics were calculated and predatory,” said W. Mike Herrington, an FBI special agent involved in the investigation.
Moucka, who used the online aliases Waifu and Judische, was arrested in Canada in late 2024, months after the Snowflake attacks.
Austin Larsen, a senior researcher at Google’s Mandiant, previously described Moucka as “one of the most consequential” hackers of 2024.
Moucka is scheduled to be sentenced on October 27 and faces decades in prison.
