In early August 2026, Connor Riley Moucka — a Canadian citizen — pleaded guilty in a US federal court in Seattle to four counts: computer fraud, wire fraud, aggravated identity theft, and conspiracy.
The scale of what he did: over 165 Snowflake customer accounts breached, data belonging to more than 100 million people stolen. Named victims include AT&T (over 100 million call and text records), Ticketmaster, Santander, Neiman Marcus, LendingTree, and Pure Storage — one of the largest data breaches of the past few years.
Here's the detail that matters most: this wasn't a hack of Snowflake's infrastructure. There was no exploit, no zero-day, no sophisticated intrusion technique. Moucka got in through customer accounts that simply didn't have multi-factor authentication enabled. A password was enough.
The financial picture: more than 2.5 million USD in ransom extorted directly from victims, of which at least roughly 495,000 USD went to him personally; the victims suffered damages of over 9.5 million USD.
Between the February–October 2024 attacks and the guilty plea in early August lies a genuinely international investigation: several international law enforcement agencies were involved. Sentencing is expected on 27 October 2026; he faces up to 32 years in prison.
One sobering point: the guilty plea changes nothing for the people affected. Their data is already circulating, and civil lawsuits continue independently of the criminal case.
The uncomfortable takeaway: one of the most damaging breaches in recent memory didn't require a brilliant attacker — it required 165 organisations that hadn't turned on a setting most platforms offer for free.
Is MFA enforced on every account with access to your critical systems — not just the ones you'd assume?
Update/correction of 13 October 2026: Personal details on the defendant, the exact date of the guilty plea (previously: 5 August), the mentions of BreachForums, individual agencies and John Erin Binns removed; ransom amount, personal proceeds (at least roughly 495,000 USD), damages (over 9.5 million USD) and sentence (date 27 October 2026, up to 32 years; previously: 2 to 30 years) clarified.
Research as of: August 17, 2026 — Regulation evolves quickly; this post does not replace individual legal or professional advice.
