Snowflake extortionist admits 165-victim cloud crime spree – and squeezing one target twice

Connor Riley Moucka, a 26-year-old Canadian, has pleaded guilty in the US to multiple charges related to orchestrating a vast cloud data theft campaign linked to the Snowflake software provider. Moucka and his associates admitted to breaking into the cloud environments of at least 165 organizations between February and October 2024, exposing sensitive customer records and demanding ransom payments.

They used stolen login credentials to gain access to the systems, targeting valuable data such as banking records, payroll information, and personal identification numbers. The group returned to at least one victim twice, extorting additional payments after the first ransom demand was met. Moucka and his co-conspirators advertised the stolen data on various cybercrime forums and social media platforms, demanding ransom amounts totaling around $6 million.

They ultimately received approximately $2.5 million in Bitcoin. Moucka admitted to pocketing at least $495,000 from the scheme. The victims suffered over $9.5 million in direct losses, affecting at least 100 million individuals whose personal information was compromised. Moucka was arrested in Canada in October 2024 and extradited to the US in July.

He is set to be sentenced on October 27, facing a mandatory two-year prison term for aggravated identity theft.