Connor Riley Moucka, a 26-year-old Canadian national from Kitchener, Ontario, pleaded guilty on Wednesday, August 5, 2026, in a Washington state federal court to computer fraud, wire fraud, aggravated identity theft and a related conspiracy, closing the criminal case on one of the largest multi-victim cloud intrusion campaigns on record. The U.S. Department of Justice says Moucka and his co-conspirators used stolen login credentials between February and October 2024 to reach cloud-hosted data belonging to at least 165 customer organizations of a U.S.-based software-as-a-service provider, stealing billions of sensitive records and extracting more than $2.5 million in ransom payments. The Record identifies the platform explicitly as Snowflake; the DOJ announcement summarized by MyNorthwest describes it only as a U.S.-based SaaS company and does not name it. Moucka faces up to 32 years in prison and is scheduled for sentencing on October 27, 2026.
A note on the victim count: the 165-organization figure appears consistently across Dark Web Informer, The Record and the DOJ-sourced MyNorthwest report, all of which frame it as "at least" or "more than" 165. Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division, quoted in the DOJ statement, used a lower and rounder "over 150 companies and organizations." MyNorthwest's headline additionally puts the downstream human impact at 100 million people, a figure not corroborated in the other sources reviewed here and best treated as that outlet's characterization rather than a confirmed court-established number.
What Happened
According to charging documents summarized by the DOJ, the campaign ran roughly nine months, from February to October 2024. Moucka and co-conspirators did not exploit a vulnerability in the SaaS platform itself. They authenticated with credentials stolen elsewhere and then moved through the cloud tenancies of the platform's customers, downloading terabytes of data from each. Once the data was in hand, the group pivoted to extortion, threatening to publish victims' customer records online unless paid. Court documents cited by MyNorthwest confirm the group collected more than $2.5 million in ransom payments, and that in at least one case Moucka "re-extorted" a victim he had already been paid by, threatening further release of the same stolen data.
The Record reports the victim roster includes AT&T, Ticketmaster, Advance Auto Parts, Neiman Marcus, Santander and one of the largest school districts in the United States. Moucka was arrested approximately six months after the intrusion campaign began. Duva framed the arrest timeline as evidence of the Department's responsiveness, noting Moucka "hacked over 150 companies and organizations, obtained extremely sensitive information, and extorted the victims for millions of dollars."
What Was Taken
The stolen data set is unusually broad in category, which is what makes this campaign a durable identity-fraud problem rather than a one-cycle credential reset. Per the DOJ's description, the exfiltrated material included:
- Non-content call and text history records
- Banking and other financial information
- Payroll records
- Drug Enforcement Administration registration numbers
- Driver's license numbers
- Passport numbers
- Social Security numbers
- Additional personally identifiable information
On volume, the sources are directionally consistent but not identical in phrasing. The DOJ describes "billions of sensitive customer records" and "terabytes of information." The Record independently characterizes the haul as "billions of files." Both formulations point to the same order of magnitude; no source reviewed here provides a precise record count. MyNorthwest's 100 million affected individuals is the only per-person figure offered and stands alone.
The DEA registration numbers deserve separate attention. Those identifiers gate controlled-substance prescribing authority, and their presence in a criminal extortion data set creates a prescription-fraud exposure that ordinary breach remediation does not address. The DOJ also states Moucka used stolen data belonging to a government official, though the sources reviewed here do not detail how.
Why It Matters
The strategic lesson is that the SaaS platform was never breached in the sense defenders usually mean. Valid credentials were presented, and the platform did what it was designed to do. Every downstream victim was, from the platform's perspective, an authorized session. That model of compromise scales in a way that vulnerability exploitation does not: one credential-harvesting operation multiplied into 165 organizational breaches without a single zero-day.
That pattern is not confined to this case. TechCrunch reported in June 2026 that Vancouver-based market research firm Klue traced breaches of its own corporate customers, including password manager maker LastPass and several other cybersecurity companies, to a legacy credential originally issued to a third party in 2022 for a limited pilot and apparently never revoked. Klue detected the intrusion on June 12, 2026 and disclosed it the following week. The attackers used access to Klue's systems, which hold OAuth tokens for customers' data in other clouds and databases, to pull that data and extort the companies. Klue declined to tell TechCrunch what the pilot was for, how long it ran, who the third party was, or why the credential survived the pilot's end. Different actors, different platform, same structural failure: a forgotten credential with standing access to customer data across tenancy boundaries.
Readers should note that four of the eight sources supplied for this brief cover an entirely unrelated matter. Aubrey Cottle, a 39-year-old Oshawa, Ontario hacktivist known as Kirtaner and associated with Anonymous, was sentenced on June 26, 2026 to 18 months by Justice Joseph Di Luca of the Ontario Superior Court, reported by The Globe and Mail, HackRead, SC Media and the published reasons for sentence at R. v. Cottle, 2026 ONSC 3774. Cottle pleaded guilty to unauthorized use of a computer, mischief to data and failing to comply with a release order, arising from the September 11, 2021 defacement of the Texas GOP website and the theft of 180 GB of data via hosting provider Epik. That case shares a nationality and a guilty plea with the Moucka matter and nothing else. It is a separate defendant, separate conduct, separate jurisdiction and separate legal system. Conflating the two, as headline-level aggregation easily does, produces a false composite actor.
The Attack Technique
Initial access was credential-based, not exploit-based. The DOJ states plainly that Moucka and his co-conspirators "used stolen login credentials to compromise cloud-hosted data." The Record's account matches. Neither source reviewed here specifies how the credentials were originally obtained, and no source claims the SaaS provider's own infrastructure was penetrated.
The operational chain, as described across the DOJ summary and The Record, follows a repeatable four-step shape:
- Obtain valid credentials for customer cloud tenancies from outside the target environment
- Authenticate to the SaaS platform as a legitimate customer user
- Bulk-export data at terabyte scale from each accessible tenancy
- Extort the data owner directly, with repeat extortion of at least one victim
The decisive control gap is authentication. A stolen username and password alone should not have been sufficient to authorize bulk export from 165 separate customer environments. The Klue incident, while a distinct case, illustrates the adjacent gap: credentials and OAuth tokens that outlive the business purpose they were issued for and retain their original scope indefinitely.
What Organizations Should Do
-
Enforce phishing-resistant MFA on every SaaS tenancy, without optional bypass. Credential-only authentication is the single condition that made this campaign scale. Where the platform allows customers to disable or exempt MFA, treat that setting as a critical finding, not a configuration preference.
-
Inventory and expire every non-human credential. Service accounts, API keys, OAuth tokens and integration credentials should carry a documented owner, purpose and expiry. Klue's own account to TechCrunch, that a 2022 pilot credential given to a third party was still live in 2026, is the failure mode to audit against.
-
Alert on bulk export volume, not just on failed logins. Every action in this campaign occurred inside an authenticated session. Detection has to key on behavior: query volume, row counts, export destinations and off-hours access patterns that deviate from a user's baseline.
-
Enforce network allowlisting and device trust for data warehouse access. Restricting authentication to known corporate egress ranges or managed devices would have blunted a purely credential-driven attack even after the credentials leaked.
-
Treat your SaaS provider's breach as your breach, contractually and operationally. The 165 victims here were each independently responsible for their own notifications and their own regulatory exposure. Confirm now that your agreements specify log access, incident notification timelines and forensic cooperation.
-
Map which regulated identifiers live in cloud analytics platforms. DEA numbers, passport numbers and SSNs sitting in a data warehouse for reporting convenience are the reason this breach converts into long-tail fraud. Tokenize or remove what analytics does not actually need.
-
Plan for re-extortion. Payment did not end the threat for at least one victim in this case. Build the assumption of repeat contact into incident response and legal planning rather than treating settlement as closure.
Sources: Canadian Hacker Pleads Guilty in Cloud Breach Spree Affecting More... | Canadian man pleads guilty to Snowflake hacks that led to 165 breac... | Canadian hacker Aubrey Cottle sentenced to 18 months custody after... | Anonymous-Linked Hacktivist Aubrey Cottle Jailed Over Texas GOP Cyb... | Canadian hacker sentenced for Texas Republican Party website deface... | Klue says hackers stole credential from 2022 that led to customer d... | 'Hiding behind a screen': Canadian hacker pleads guilty in data bre... | His Majesty the King v. Aubrey Cottle, 2026 ONSC 3774