Canadian hacker pleads guilty, 165 orgs

Connor Riley Moucka, a 26-year-old from Kitchener, Ontario, pleaded guilty on August 5 in federal court in Seattle to computer fraud, wire fraud, aggravated identity theft and a related conspiracy tied to the 2024 Snowflake customer-account intrusions. U.S. prosecutors said the campaign compromised more than 165 organizations, stole billions of sensitive customer records and led to extortion demands against multiple victims. (justice.gov) The Justice Department said the case involved a U.S. cloud storage provider and customers whose data was later offered for sale or used in ransom attempts. (thehackernews.com) Moucka is one of the central defendants in a hacking spree that authorities say hit companies and exposed data belonging to at least 100 million people. (cbc.ca) ### How did prosecutors say the intrusions worked? The Justice Department said Moucka and his co-conspirators targeted customer environments connected to Snowflake and then stole large volumes of data from victim organizations. Prosecutors said the group used the stolen information in two ways: by trying to extort companies directly and by advertising or selling data on criminal forums. CBC reported that prosecutors tied the conduct to breaches at customers including AT&T, Live Nation’s Ticketmaster and Santander Bank. The Justice Department said Moucka extorted victims for millions of dollars between February and October 2024. (justice.gov) ### What numbers stand out in the plea? At least 165 victim organizations were compromised, according to the Justice Department, and The Hacker News reported the exposed records belonged to at least 100 million people. The department also said the conspiracy involved billions of sensitive customer records. (justice.gov) A plea agreement cited by CBC said Moucka and his co-conspirators obtained 36 bitcoin, worth about $2.5 million at the time, from at least three victims. CBC also reported that the group sought at least $6 million in other attempts to sell stolen data. (cbc.ca) ### What did U.S. officials say in announcing the plea? Assistant Attorney General A. Tysen Duva said Moucka “hacked over 150 companies and organizations,” obtained highly sensitive information and extorted victims for millions of dollars. Duva said the arrest came six months after the breaches began and called the case a sign of the department’s focus on cybercrime prosecutions. (justice.gov) FBI Cyber Division Assistant Director Brett Leatherman said the plea showed that “hiding behind a screen is no shield from justice.” W. Mike Herrington, the FBI special agent in charge in Seattle, said Moucka’s threats and “re-extortion tactics” caused harm both to the companies targeted and to their customers. (cbc.ca) ### Who else has been named in the case? John Erin Binns was charged in the case in April 2025, according to CBC. A Justice Department case page for the Western District of Washington lists Moucka and Binns as defendants and said Moucka first appeared in that court on July 3, 2025 after extradition from Canada. (justice.gov) Court records cited by the Justice Department said Moucka had originally pleaded not guilty after his extradition. The case page said a trial had been set for October 19, 2026 before U.S. District Judge Lauren King before the guilty plea changed the schedule. (justice.gov) ### What happens next in court? Moucka is scheduled to be sentenced on October 27 in U.S. District Court for the Western District of Washington, CBC reported. CBC said the aggravated identity theft count carries a mandatory minimum sentence of two years, while the remaining counts carry a maximum penalty of 30 years. (cbc.ca) The Justice Department said the investigation involved the FBI and international law-enforcement partners, including the Royal Canadian Mounted Police. Further proceedings in the case against other defendants remain on the court docket in Seattle. (justice.gov) (cbc.ca) (justice.gov)