The US Department of Justice is charging two hackers suspected of breaching more than 165 organizations using the services of cloud company Snowflake.
The two suspects, Connor Riley Moucka and John Erin Binns , are accused of using credentialsobtained with the help of phishing malware to compromise Snowflake accountsthat were not protected by multi-factor authentication.
Moucka and Binns stole massive amounts of data from various companies and demanded ransom in exchange for deleting the stolen information.
See also: Cyberattack disrupts payment systems in Israel
According to the indictment, the two hackers stole “approximately 50 billion records related to customer calls and messages” from a “major telecommunications company” in the U.S.
One company that suffered a major data breach during the period described in the indictment is AT&T. AT&T disclosed in July that the call logs of 109 million customers were exposed during a breach and that attackers accessed the data from an online database in the company's Snowflake account.
According to the indictment, Moucka and Binns received ransom money from the telecommunications provider in the form of cryptocurrency around mid-May. They attempted to conceal the source and destination of the funds through “a complex series of transactions,” which included converting the payments into the cryptocurrency Monero.
In some cases, attackers were trying to re-extort a company that had already paid a ransom.
See also: The 15 vulnerabilities most used in attacks in 2023
The court document notes that the two Snowflake hackers and associates demanded at least 36 Bitcoins, or $2.5 million at the time of the transaction, from three victims.
In addition to AT&T, data breaches linked to Snowflake attacks affected hundreds of millions of people, customers of Ticketmaster, Santander, Pure Storage, Advance Auto Parts, Los Angeles Unified, QuoteWizard/LendingTree and Neiman Marcus.
If victims did not pay the ransom, the hackers sold the stolen data to buyers on hacking forums.
Moucka (also known as “Waifu” and “Judische”) was arrested in late October 2024 in Canada at the request of the United States, which suspected the man of being the mastermind behind the data.
Binns , he claimed responsibility for the major attack on T-Mobile.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The two now face multiple charges of fraud, unauthorized access and system breach, data theft and privacy. If convicted, they could face significant prison sentences (up to 60 years).
See also: Snowflake attacks: Pure Storage also breached
In addition, the government will seize their assets and proceeds, including bank accounts, vehicles, real estate, and any other assets acquired through illegal activities.
The arrests and charges against the two hackers underscore the growing focus on cybersecurity and the importance of protecting cloud services from sophisticated cyber threats. Snowflake, a prominent player in the cloud, has become an attractive target due to the sheer volume of sensitive customer information it holds.
The attacks, which were observed, highlight the need for businesses to adopt robust cybersecurity measures, including regular risk assessments, advanced encryption protocols, and continuous monitoring of network activities to prevent potential attacks.
Source: www.bleepingcomputer.com
