SEATTLE, 9 AUG 2026 — Connor Riley Moucka pleaded guilty this week to the campaign that emptied data from more than 165 organisations using Snowflake. Two years on, the fact that has not changed is how he got in: stolen passwords, against accounts with no multi-factor authentication.
No Snowflake vulnerability was ever involved. That was true when the breaches surfaced in 2024, it survived the indictment, and it survived the plea.
What he pleaded to
Moucka, 26, of Kitchener, Ontario, and known online as "Judische" and "Waifu", pleaded guilty on 6 August to four counts: computer fraud, wire fraud, aggravated identity theft and conspiracy. Sentencing is set for 27 October.
The aggravated identity theft count carries a mandatory minimum of two years. The remaining counts could add up to thirty. Where in that range he lands on 27 October is the only open question left in the case.
The victim list explains the scale: Ticketmaster, LendingTree, Advance Auto Parts and Neiman Marcus, plus an AT&T dataset with more than 100 million customers' call and text records. What was taken across the campaign included social security numbers, driving licences, passport numbers, DEA registration numbers and financial information — billions of records, terabytes downloaded.
At least one victim was extorted twice.
The mechanism has not aged
The attackers used existing credentials harvested elsewhere to access accounts on the cloud data platform protected only by a password.
Every element of that remains available today. Infostealer malware continues to produce credential dumps at industrial volume, password reuse has not stopped, and a data warehouse account without a second factor is still just a password away from whatever the warehouse holds. Nothing about the technique required skill that has since been mitigated.
What made the campaign unusual was not the entry, it was the aggregation. A cloud data platform is where an organisation puts everything so that it can be queried in one place, which is enormously useful and means a single credential reaches a superset of what any individual system would have yielded. The design that makes the platform valuable also made the breach large.
Where the passwords came from
The credentials in this campaign were not guessed. They were harvested, and the harvesting is an industry.
Infostealer malware runs on an ordinary person's machine — often arriving through pirated software, a malicious advert or a fake installer — and exfiltrates every saved password, session cookie and authentication token the browser holds. The output is sold in bulk. A corporate login sitting in a contractor's personal browser reaches the same market as their streaming subscription, and it is priced accordingly.
This is why "the password was stolen" understates the problem. There is no phishing email for a defender to train against and no intrusion at the company to detect, because the theft happened on a machine the company does not own, possibly years before it was used. By the time the credential is exercised, it is a valid login from an unremarkable client.
Which leaves multi-factor authentication carrying almost the entire weight. It is the one control that still works when the password is already in someone else's hands, and it was the control that was absent.
Whose failure it was
This case settled an argument that recurs every time a platform's customers are breached in bulk, and it is worth being precise about the answer.
Snowflake was not compromised. The customers' accounts were, through their own credentials and their own configuration. On the strict reading, each of those 165-plus organisations failed to enforce a control available to them.
The strict reading is also incomplete. When a hundred and sixty-five customers of one platform make the same configuration mistake, the more useful question is what the default was. A security control that must be switched on by every customer independently will be missing at some rate, and that rate is a property of the product's design rather than of any one customer's diligence. The industry has since moved decisively toward mandatory multi-factor authentication on this class of platform, which is itself an admission about where the responsibility sat.
While the customers should have enabled it, the outcome was predictable enough that leaving MFA optional was a choice with a known failure rate.
The rest of the case
Moucka is not alone in it. Cameron Wagenius, known as "Kiberphant0m" and a serving US Army soldier when charged, pleaded guilty in July 2025. John Erin Binns, charged alongside Moucka in the eleven-count indictment unsealed in November 2024, left the United States; he has reportedly been released from a Turkish prison and obtained Turkish citizenship.
The last detail carries a lesson. Two of three have pleaded, and the third is in a jurisdiction from which return is not straightforward. Prosecution works on the participants a prosecutor can reach, which is a real constraint on deterrence in cases where the crime is committed from anywhere.
What to do about it, still
The remediation for this campaign has not changed in two years, which is either reassuring or damning depending on how your own estate looks.
Enforce multi-factor authentication on every data-platform account, without exception for service accounts, contractors or the analytics team's shared login. Those exceptions are how the control ends up absent on the one account that mattered.
Then check what a single credential can reach. The reason a warehouse breach is catastrophic rather than annoying is that everything is in it; role scoping and per-dataset access limits are the difference between one team's data and the company's.
And monitor authentication rather than only data access. A login from an unexpected location using a valid password produces no alert in most configurations, because nothing is technically wrong. That was the whole of the entry in this case.
What to watch
The sentence on 27 October, which will be the first substantial data point on how US courts price a campaign of this scale when the defendant cooperates through a plea. Whether any of the 165 organisations faces regulatory action of its own for the missing control. And whether Binns's status changes, because an unreachable co-defendant is the part of this case that does not resolve.
View author profile → · Editorial policy
