Hacker Connor Moucka Pleads Guilty After Stealing Data from Over 165 Snowflake Clients

A major cyber‑crime case has reached its conclusion as U.S. hacker Connor Moucka formally admitted to breaching more than 165 Snowflake customers and demanding ransom for the stolen information. The indictment revealed that Moucka, together with a small group of accomplices, extracted sensitive data and secured payments exceeding $2.5 million.

Snowflake, a leading cloud‑based data‑warehousing platform, has long emphasized its security architecture, yet the breach underscores how determined attackers can still navigate complex defenses. According to prosecutors, Moucka leveraged a series of sophisticated intrusion techniques, beginning with phishing emails that compromised employee credentials and escalating to the exploitation of misconfigured cloud storage buckets. The compromised assets ranged from financial statements and product roadmaps to, in some cases, personally identifiable information.

Rather than selling the data on underground markets, the conspirators opted for a classic ransomware approach: they directly contacted the affected organizations, demanding payment in exchange for the return of the data or the promise not to release it publicly. Payments were made through a mix of cryptocurrency wallets and anonymized bank transfers, making traceability difficult for investigators. The total ransom sum topped $2.5 million, though authorities suspect additional costs were incurred through extortion fees and forced legal consultations.

During the courtroom hearing, Moucka entered a plea of guilty, acknowledging his role and cooperating with investigators to identify co‑conspirators. The presiding judge, taking into account the scale of the breach and the financial harm inflicted on the victims, imposed a lengthy prison sentence coupled with a substantial monetary fine.

In response, Snowflake announced an immediate rollout of enhanced security controls, including stricter access policies, real‑time anomaly detection, and a more transparent breach‑notification protocol for its clients. The case serves as a stark reminder for cloud service providers and enterprises alike: robust encryption, continuous monitoring, and a well‑drilled incident‑response plan are essential to thwart sophisticated threat actors. Moreover, organizations are urged to develop rapid ransom‑payment decision frameworks to mitigate damage while preserving data integrity.

Source: TechCrunch

ETİKETLER