Hacker Pleaded Guilty in Massive Snowflake Data Breach
The campaign compromised over 100 million records by targeting customer accounts lacking multi-factor authentication.
Updated on Sept. 27, 2026 in Cybersecurity
Live Poll
Do you trust that major cloud-based platforms are doing enough to protect your personal information?
On August 10, 2026, Connor Riley Moucka pleaded guilty to computer fraud and identity theft charges for his role in a hacking operation that exposed the personal data of more than 100 million individuals. The incident, which occurred between February and October 2024, resulted in $9.5 million in total losses for victim companies.
Why it matters
This case highlights the catastrophic risks posed by account security gaps in cloud infrastructure, where stolen credentials can bypass perimeter defenses. The incident serves as a primary example of how credential harvesting via infostealer malware creates systemic vulnerabilities for enterprise clients.
The attackers used infostealer malware to harvest login credentials and specifically identified Snowflake tenant accounts that lacked multi-factor authentication. By deploying custom tools to exfiltrate data, the perpetrators caused $9.5 million in verified losses across affected victim organizations.
The players
Connor Riley Moucka
The defendant who pleaded guilty to computer fraud and extortion charges after orchestrating a large-scale data theft campaign.
Snowflake
A cloud-based data storage and analytics company that mandated multi-factor authentication following the breach of its customer accounts.
The details
The hack utilized infostealer malware—malicious code designed to scrape saved passwords, browser cookies, and session tokens from infected devices—to gain unauthorized access to Snowflake environments. Once inside, the perpetrators used custom extraction scripts to identify and download massive datasets from accounts where multi-factor authentication (MFA) was not enforced. The scope of the exfiltration was exacerbated by the attackers' ability to maintain persistence and perform follow-up re-extortion attempts using sensitive data, including records of a government official.
Timeline
February 2024 to October 2024: The hacking and extortion campaign occurred.
October 2024: Connor Riley Moucka was arrested in Canada.
August 10, 2026: The guilty plea occurred in U.S. federal court.
October 27, 2026: Scheduled sentencing for Connor Riley Moucka.
The Tech Race
The scale of this breach aligns with the 2017 Equifax data breach, marking a shift toward large-scale exploitation of enterprise cloud account vulnerabilities. This incident follows a pattern where attackers leverage stolen credentials to bypass traditional network perimeters, forcing a rapid industry-wide move toward mandatory multi-factor authentication.
The incident reinforces the necessity of using multi-factor authentication (MFA) on all cloud-connected business and personal accounts. Users should monitor for account alerts and implement unique, complex passwords to mitigate the effectiveness of credentials stolen by infostealer malware.
The takeaway
This case confirms that credential theft remains the primary vector for large-scale data compromises in cloud-hosted environments. Watch for the sentencing outcome on October 27, 2026, to determine the judicial precedent established for international digital extortion and identity theft.
What happens next
Connor Riley Moucka is scheduled to be sentenced in U.S. federal court on October 27, 2026.
Further reading
For more information on defensive strategies for enterprise cloud infrastructure, visit Cybersecurity.
Source note: This article includes information reported by Computer Crime Research Center.
Live Poll
Do you trust that major cloud-based platforms are doing enough to protect your personal information?
