Snowflake Breach: Canadian Pleads Guilty to 165-Organization Data Theft, 100 Million Individuals Affected
On **August 5, 2026**, **Connor Riley Moucka**, 26, pleaded guilty in a US federal court for his role in breaching **Snowflake** customer accounts. With accomplice **John Erin Binns**, he exfiltrated terabytes of data from **165 organizations** by exploiting absent **MFA**. The verdict lands two years after the facts — the lesson for cloud teams is unequivocal.
August 5, 2026, 5:53 PM EDT. Connor Riley Moucka, 26, also known as Waifu, stands before a US federal court and pleads guilty to four counts: computer fraud, wire fraud, aggravated identity theft, and conspiracy. His crime — siphoning data from 165 organizations hosted on Snowflake between February and October 2024, affecting over 100 million individuals and causing $9.5 million in losses.
The Snowflake case is not a zero-day story. It is a masterclass in cloud security hygiene — and the direct consequence of trusting perimeter defenses without the most basic safety net available.
Anatomy of a No-Break-In Heist
Moucka and Binns’s modus operandi was disarmingly simple:
- Credential harvesting. Using infostealers — malware that vacuums up browser-stored passwords — the attackers collected valid username/password pairs for Snowflake accounts.
- Direct login. The targeted accounts had no MFA enabled. A simple login/password combo sufficed to access the cloud environment.
- Automated reconnaissance. Once inside, Moucka and Binns used custom software to map out instances: organization names, user roles, IP addresses, storage paths.
- Mass exfiltration. Multiple terabytes of data were downloaded from Snowflake tenants.
- Extortion. Victims were contacted with ransom demands payable in bitcoin. At least three organizations paid, totaling $2.5 million. Moucka also resold the data on hacker forums, pocketing an additional $495,000.
The stolen data included call and text history records, banking and financial information, and other personally identifiable information (PII).
The Victims: A Who’s Who of American Giants
The list of affected organizations shows the scope of the compromise:
| Organization | Sector |
|---|---|
| AT&T | Telecommunications |
| Ticketmaster | Ticketing/Entertainment |
| Santander | Banking |
| Pure Storage | IT Storage |
| Advance Auto Parts | Auto Parts Retail |
| Neiman Marcus | Luxury Retail |
| Los Angeles Unified | Public Education |
| QuoteWizard/LendingTree | Fintech |
“In at least one instance, Moucka re-extorted a victim with threats of further disclosure of the victim’s stolen data,” the US Department of Justice noted.
Moucka used the stolen data of a government officer and members of that officer’s immediate family in this re-extortion attempt — a level of harassment that goes well beyond simple profit-seeking.
Why MFA Was Not Enabled
The question every CISO is asking: why did 165 organizations — including giants like AT&T and Santander — not have MFA enabled on their Snowflake accounts?
The answer is likely multi-layered:
- Snowflake did not require it at the time. Before these incidents, the platform recommended MFA without making it mandatory. Since then, Snowflake has announced mandatory MFA and imposed a minimum 14-character password requirement.
- Service accounts and automation. Data pipelines often use service accounts where MFA is deemed “too complex” to integrate. This trade-off proved extraordinarily expensive.
- False sense of security. Data is in the cloud, behind an “enterprise-grade” provider — why worry? This attitude is exactly what attackers exploit.
Snowflake’s Response and Cloud Team Lessons
Snowflake reacted by updating its terms of service to require MFA for all accounts and strengthening password complexity requirements. But the responsibility does not stop at the provider.
Three concrete actions for cloud teams:
- Universal MFA. No exceptions — service accounts included. Use programmatic MFA solutions (certificates,
aws-sdkwith MFA tokens, HashiCorp Vault) for CI/CD pipelines. - Continuous access auditing. Enable access logs (Snowflake
LOGIN_HISTORY,QUERY_HISTORY) and correlate them with your SIEM. A login from an unknown IP without MFA must generate a critical alert within 5 minutes. - Credential rotation and infostealer awareness. Stolen browser passwords enabled this attack. Enforce regular rotation, ban credential storage in browsers on corporate machines, and deploy an EDR capable of detecting infostealers.
Verdict
The Moucka case is closed on the judicial side — he faces up to 32 years in prison, with sentencing scheduled for October 27, 2026. But the lesson for cloud teams is permanent.
If your data lives in Snowflake — or any other SaaS/cloud provider — and you have not enabled MFA on 100% of your accounts, stop reading this article and enable it. Now.
If you manage a production data pipeline, replace static-password service accounts with programmatic authentication backed by a secret manager. The $2.5 million extorted from three victims would have been impossible if a simple second factor had been required.
The cloud does not forgive minimal security hygiene.
References
- BleepingComputer, Canadian pleads guilty to Snowflake cloud data-theft attacks, August 5, 2026 — https://www.bleepingcomputer.com/news/security/canadian-pleads-guilty-to-snowflake-cloud-data-theft-attacks/
- U.S. Department of Justice, press release, August 5, 2026 — Canadian National Pleads Guilty to Snowflake Data Theft Scheme
- Federal indictment, United States v. Connor Riley Moucka, District Court for the Eastern District of [sealed]