Hacker Pleads Guilty in Massive Snowflake Data Breach Affecting 165+ Customers
TL;DR
- Connor Moucka pleaded guilty to orchestrating a massive cyberattack on Snowflake, compromising over 165 customer accounts and extorting more than $2.5 million in ransom payments.
- The attack exploited stolen customer credentials—many lacking multi-factor authentication (MFA)—rather than a vulnerability in Snowflake’s core platform, allowing attackers to harvest sensitive data from major corporate victims.
- Moucka faces decades in prison and forfeiture of millions, while the case underscores a critical shift toward prosecuting cybercriminals for data extortion and forces enterprises to rethink cloud identity security.
The Guilty Plea: A Landmark Admission
In a federal courtroom this week, Connor Moucka, a 26-year-old Canadian national, formally pleaded guilty to charges stemming from one of the most consequential cloud data breaches in recent memory. Moucka admitted to orchestrating a campaign that infiltrated more than 165 Snowflake customer environments, exfiltrating terabytes of proprietary data and extorting victims for over $2.5 million in cryptocurrency alongside his co-conspirator, John Binns.
The plea marks a decisive legal victory for prosecutors, who have been under mounting pressure to hold cybercriminals accountable for large-scale data extortion. Moucka now faces a statutory maximum of 20 years in federal prison for conspiracy to commit computer fraud and extortion, plus additional counts related to wire fraud and aggravated identity theft. As part of the plea agreement, he has agreed to forfeit millions in seized digital assets, including Bitcoin and Monero traced to ransom payments.
How the Attack Unfolded: Credential Harvesting, Not a Platform Flaw
Perhaps the most critical detail to emerge from court documents is that Moucka did not exploit a zero-day vulnerability in Snowflake’s infrastructure. Instead, he leveraged a combination of previously stolen credentials—harvested from infostealer malware campaigns targeting Snowflake customers’ employees—and a shocking lack of basic security hygiene across those enterprises.
The attack method was deceptively simple:
1. Credential Acquisition: Moucka and his team purchased or freely obtained massive datasets of usernames and passwords from underground markets, originally harvested by infostealer trojans like RedLine and Vidar.
2. Credential Stuffing: They systematically tested these credentials against Snowflake’s login portals, looking for accounts that had not been rotated since the initial malware infection.
3. MFA Bypass: In a staggering number of cases, the compromised accounts had no multi-factor authentication enabled. Where MFA existed, Moucka reportedly used session token theft—stealing active cookies from infected machines to impersonate legitimate users without needing a fresh login.
4. Lateral Movement and Data Exfiltration: Once inside, the attackers used Snowflake’s native features—such as external storage integration and SQL queries—to bulk-export customer data to their own infrastructure.
Court filings reveal that Moucka specifically targeted high-value accounts in sectors like healthcare, financial services, and technology. Victims included major names like Ticketmaster, AT&T, and Santander Bank, though many smaller enterprises were also hit. Stolen data ranged from customer PII and payment card numbers to call logs and proprietary business analytics.
The Extortion Playbook: Fear, Pressure, and Bitcoin
Moucka’s extortion strategy was as methodical as his intrusion. After exfiltrating data, he would contact victims via encrypted messaging apps, presenting proof of the breach and demanding ransoms typically ranging from $100,000 to $1 million per victim.
The plea documents show a chilling pattern: Moucka threatened not just to leak the data publicly, but to sell it to other criminal groups. In several cases, he applied pressure by publishing small samples of stolen data on dark web forums, forcing victims to negotiate quickly. The $2.5 million total represents only the payments that were successfully traced; prosecutors believe the actual extortion demand across all 165+ victims was significantly higher.
His accomplice, John Binns—who is also charged in connection with a separate 2021 T-Mobile breach—remains at large and is believed to be overseas. Moucka’s cooperation with prosecutors is expected to play a key role in Binns’ eventual capture and prosecution.
Legal Repercussions: A New Deterrent?
Moucka’s guilty plea is significant not just for the victims, but for the broader legal landscape of cybercrime. Historically, many hackers operating from foreign countries have viewed data extortion as a low-risk, high-reward activity, rarely facing extradition or prosecution. This case changes that calculus.
The Department of Justice has signaled that Moucka’s prosecution is a template for future cases involving cloud service providers. The charges specifically focus on the extortion aspect as a federal crime, separate from the computer intrusion itself, which allows prosecutors to stack charges and seek longer sentences. Furthermore, the forfeiture of cryptocurrency ransoms sends a clear message: the financial gains are no longer safe.
Legal experts note that Moucka’s decision to plead guilty—rather than fight extradition from Canada—likely reflects the strength of the evidence against him, including blockchain analysis linking ransom wallets to his identity and forensic evidence recovered from his seized devices.
What This Means for Enterprise Cloud Security
For CISOs and security teams, the Snowflake breach is a sobering reminder that the cloud provider is only as secure as the customer’s identity and access management practices. Snowflake has repeatedly emphasized that its core platform was not compromised, but that does little to comfort the 165+ organizations that lost data.
Key takeaways for enterprises:
MFA is non-negotiable: The vast majority of compromised accounts lacked MFA. Even where it was present, session token theft defeated it. Organizations must adopt phishing-resistant MFA (e.g., hardware keys) and enforce strict session timeouts.
Credential hygiene is critical: Infostealer malware is the gateway. Companies must continuously monitor for compromised credentials on the dark web and force password resets immediately upon detection.
Least-privilege access: Many victims had service accounts with overly broad permissions. Limiting Snowflake roles to only what’s necessary reduces the blast radius of a single compromised account.
Network egress monitoring: Attackers exfiltrated data via SQL queries and storage integrations. Anomalous large-volume exports should trigger automated alerts and blockades.
The breach has also accelerated the adoption of zero-trust architectures in cloud environments, where every session—even from a valid account—is continuously verified for risk.
The Road Ahead: Justice and Prevention
Moucka’s sentencing is scheduled for late 2026. Given the severity of the charges and the scale of victim impact, prosecutors are expected to seek the maximum sentence. His cooperation, however, could result in a reduced term, particularly if it leads to the capture of Binns or dismantling of the broader infostealer ecosystem he relied upon.
For the cybersecurity community, this case is a double-edged sword. On one hand, it demonstrates that law enforcement can and will pursue international cybercriminals with relentless forensic rigor. On the other, it highlights a systemic weakness: the global supply chain of stolen credentials remains robust, and thousands of enterprises still lag in basic security fundamentals.
The legacy of the Snowflake breach will likely be a regulatory push toward mandatory MFA and continuous credential monitoring for cloud platforms. In the meantime, Moucka’s guilty plea stands as a rare moment of accountability in a digital underworld that often feels untouchable.
Get All The Latest Updates Delivered Straight To Your Inbox For Free!