Canadian Cybercriminal Pleads Guilty in US Court Over Snowflake Account Compromise
In a recent development in cybersecurity news, a Canadian individual has admitted guilt in a United States court regarding his involvement in the extensive compromise of customer accounts belonging to Snowflake, a prominent cloud-based data warehousing provider. This breach ignited a highly profitable extortion scheme that targeted numerous victims and raised significant alarms within the tech community.
On August 5, 2026, 26-year-old Connor Riley Moucka from Ontario entered a guilty plea to various offenses linked to these high-profile data breaches that occurred between February and October 2024. His charges include computer fraud, aggravated identity theft, and conspiracy related to these crimes. Legal experts suggest that he faces a mandatory minimum sentence of two years in prison for the aggravated identity theft charge alone. Depending on the outcome of the case, the total time behind bars could extend to a staggering 30 years given the aggregate nature of the remaining offenses. Sentencing is currently set for October 27, creating a tense anticipation for both the defendant and potential victims monitoring the developments.
Moucka’s journey through the legal system began with his arrest in October 2024. This arrest followed a comprehensive investigation that saw the collaboration of law enforcement agencies from Canada, Australia, Spain, Ukraine, and Turkey. By July 2025, he had been extradited from Canada to the United States, demonstrating the international dimensions of cybercrime prosecution and the high priority that U.S. authorities place on addressing these kinds of offenses.
During the investigation, it was revealed that Moucka, along with accomplices, exploited stolen login credentials to infiltrate the accounts of at least 165 Snowflake customers. This unauthorized access enabled them to steal billions of sensitive records, including personal communication logs, financial details, and other private information belonging to individuals. The criminals leveraged this invaluable data to extort payments from their victims, issuing threats to release sensitive information online if they were not compensated.
In one particularly distressing instance, the hackers are reported to have targeted a government officer and, subsequently, their family members. This culminated in what was described as a re-extortion attempt, showcasing the lengths to which these criminals were willing to go to achieve their financial goals. According to documents from the court, Moucka and his associates reaped more than $2.5 million from ransom payments during their operations, indicating a significant criminal enterprise.
Beyond extorting victims, Moucka’s group was also noted for marketing stolen data on various cybercrime forums, including BreachForums and Telegram. Reports suggest that Moucka himself profited by at least $495,000 through these illicit transactions. The damaging implications of the breach are far-reaching; U.S. authorities estimate that victim companies faced losses amounting to over $9.5 million, a figure that does not account for the extensive losses suffered by individual customers, which is estimated to impact at least 100 million people.
The gravity of the matter was first acknowledged by cybersecurity firm Mandiant, which alerted the public to the Snowflake breach in June 2024. Mandiant’s analyses uncovered database records that traced back to a victim’s Snowflake platform from as early as April 2024. Following this initial discovery, they provided critical intelligence regarding a broader campaign targeting Snowflake customers. Mandiant’s efforts prompted Snowflake to initiate a Victim Notification Program, aimed at alerting potential victims and assisting them in securing their accounts and sensitive information.
Among the notable high-profile entities affected by this campaign were telecommunications giant AT&T and prominent ticketing firm Ticketmaster, underscoring the vulnerability of large corporations in the age of digital assaults. Following the breach and in response to the findings, Snowflake announced plans to mandate multi-factor authentication (MFA) for all customer accounts. This strategic shift aims to fortify security measures and restore confidence among existing and prospective clients, reflecting the growing necessity for robust cybersecurity in an increasingly interconnected world.
As the sentencing date approaches, the case continues to be a pivotal discussion point in the fields of cybersecurity and law enforcement, highlighting the need for stronger prevention measures and the potential repercussions of cybercriminal activity. The outcome may set a significant precedent, not only for the individuals involved but also for corporate policies and legal frameworks governing digital security in the future.