Canadian pleads guilty to Snowflake cloud data-theft attacks

Between February and October 2024, threat actors Connor Riley Moucka (aka Alexander Moucka, Waifu) and John Erin Binns exploited Snowflake customer accounts that lacked multi-factor authentication (MFA) protection. Credentials used to access these accounts were obtained via infostealer malware. Once inside, the attackers used custom-developed software to enumerate and identify valuable data within cloud storage instances, including organization names, user roles, and IP addresses. The attackers exfiltrated terabytes of data from at least 165 organizations, stealing sensitive PII including call/text history records, banking and financial information, payroll records, DEA registration numbers, driver's license numbers, passport numbers, and Social Security numbers. Stolen data was advertised and sold on hacker forums for fiat currency and cryptocurrency. Victims were extorted with threats of data disclosure; at least one victim was re-extorted using data belonging to a government officer and their family members. The attackers obtained at least $2.5 million in bitcoin from at least three extorted victims, and an additional $495,000 from selling data on forums. Total victim losses exceeded $9.5 million, with more than 100 million individuals affected. Moucka was arrested on October 30, 2024, and pleaded guilty to computer fraud, wire fraud, aggravated identity theft, and related conspiracy charges, facing a maximum sentence of 32 years.