Ex-US soldier gets 70 months for role in AT&T, Snowflake data thefts
A former U.S. Army soldier who was part of a group that stole data from telecom companies, including AT&T, has been sentenced to 70 months in prison.
Cameron John Wagenius, 22, was part of the group that hacked Snowflake customer accounts in 2024. They took data from more than 165 organizations that used the US cloud storage company, then threatened to leak it unless the victims paid.
Snowflake is a US-based cloud data storage and analytics company with more than 13,000 customers worldwide.
Wagenius, who was most recently stationed in Texas, was also ordered to pay $294,978 in restitution. He conspired to hack into telecommunications companies’ databases, access sensitive records, and extort the companies by threatening to release the stolen data unless they paid a ransom.
“Cameron Wagenius spent more than a year and a half betraying the trust placed in him as an active duty soldier by carrying out a sweeping cybercrime campaign,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division. “He targeted U.S. and foreign telecommunications companies, compromised the sensitive data of countless people, and even sought to traffic stolen information to a foreign intelligence service.”
According to court documents, between April 2023 and December 18, 2024, Wagenius used online accounts associated with the nickname “kiberphant0m” and conspired with others to defraud at least 10 victim organizations.
The group obtained login credentials for the organizations’ protected computer networks, in part by using a hacking tool called SSH Brute that Wagenius helped develop. They used Telegram group chats to share stolen credentials and discuss how to get into victim companies’ networks.
Wagenius did all this while he was on active duty with the U.S. Army.
After stealing the data, Wagenius and his co-conspirators extorted the victim organizations both privately and in public forums. They threatened to post the data on cybercrime forums such as BreachForums and XSS.is, and in other cases offered to sell it for thousands of dollars.
They sold at least some of the stolen data and used some of it for other frauds, including SIM-swapping. In total, they tried to extort at least $1 million from the victims.
“It is especially shocking that a member of our armed forces, sworn to defend Americans and their Constitutional rights, would engage in such a violation of privacy,” noted Special Agent in Charge W. Mike Herrington of the FBI Seattle field office.
In November 2024, Wagenius published two online posts that disclosed stolen call detail records belonging to a government official and to family members of another former official. The records showed information about calls, without their content. He threatened to release more records unless he was paid.
The text of one post suggested he was acting in retaliation for the then-recent arrest of another cybercriminal.
Another hacker responsible for the Snowflake breaches, Connor Riley Moucka of Canada, pleaded guilty in August and is due to be sentenced on October 27.