Snowflake hacker pleads guilty in breach of 165 firms

Connor Riley Moucka, 26, pleaded guilty in federal court to hacking the Snowflake accounts of 165 organizations and to counts of computer fraud, wire fraud, aggravated identity theft and conspiracy. He faces more than 30 years in prison and is scheduled to be sentenced on Oct. 27.

Moucka was arrested in Canada in late 2024 and extradited to the United States in July 2025. He was initially identified under the name Alexander Connor Moucka. The Justice Department tied him to a wider campaign tracked as UNC5537 that used stolen login credentials to access data stored in corporate Snowflake accounts.

Federal prosecutors identified victims that included AT&T, Advance Auto Parts, Ticketmaster, Santander Bank, Neiman Marcus, Anheuser-Busch, Allstate, Mitsubishi, Progressive and State Farm. Investigators reported the actors exfiltrated billions of records, including personal and financial information, then extorted victims and sold stolen files on hacking forums.

The Justice Department reported the group received about $2.5 million in ransom payments, and that Moucka personally obtained roughly $500,000. Targeted companies incurred estimated losses of more than $9.5 million. Officials estimate at least 100 million customers of the affected companies experienced some impact; that figure is separate from corporate losses.

Authorities linked other individuals to the campaign. A former U.S. soldier who pleaded guilty last year to hacking AT&T and Verizon systems is believed to have participated in the Snowflake intrusions. Federal filings describe the operation as coordinated and opportunistic, relying on credential theft to move into centralized cloud data repositories.

Snowflake is a cloud data storage provider used by companies to hold large volumes of customer and business information. Court documents allege the attackers accessed accounts using stolen credentials rather than exploiting vulnerabilities in Snowflake’s platform.

Moucka admitted his role in court filings and faces federal counts that carry lengthy prison terms. The case remains part of federal efforts to disrupt criminal groups that target cloud infrastructure and to hold individual operators accountable ahead of his Oct. 27 sentencing.