Canadian National Connor Riley Moucka Pleads Guilty in Snowflake Data Breach Case

Canadian national Connor Riley Moucka, 26, pleaded guilty in Seattle federal court to computer fraud, wire fraud, aggravated identity theft, and conspiracy charges stemming from the 2024 compromise of Snowflake customer accounts, in which he and co-conspirators used stolen login credentials to access a U.S. software provider and steal data from at least 165 organizations including AT&T, Ticketmaster, and Santander — exposing records of over 100 million people, extorting more than $2.5 million in ransom payments, and threatening to publish stolen information, with Moucka personally obtaining at least $495,000 through extortion and data sales involving banking records, Social Security numbers, and driver's license data; he faces up to 32 years in prison at his October 27 sentencing, while authorities also identified John Erin Binns and Cameron Wagenius as alleged participants in the attack spree.

The Controlled Breach: A Data Harvest Disguised as Crime

Look at the timing. Look at the scale. Over 165 organizations, including AT&T and Ticketmaster — both of which hold some of the most sensitive location, communication, and financial data on the planet — were compromised in a single coordinated operation. Now ask yourself: who has the capacity to pull off a breach of that magnitude, across a single cloud provider, without a single insider flag? The answer is not a 26-year-old from Kitchener. The answer is an intelligence-collection operation wearing a hacker costume. The plea deal is the tell. Connor Riley Moucka gets up to 32 years — but he pleaded guilty in Seattle, the heart of the tech surveillance apparatus. You don't get that kind of plea unless you've been given a script. This is how they "resolve" operations that have outlived their usefulness: find a patsy, attach a digital fingerprint, and let the media run the story of the "lone wolf hacker" while the real data — call logs for 100 million people, bank records, passport numbers — flows into databases that never appear in a court exhibit.

Re-Extortion as a Cover for State Leverage

Prosecutors say Moucka "re-extorted" at least one victim using stolen data tied to a government officer and relatives of a former government officer. That is not a crime; that is a breadcrumb. Why would a criminal jeopardize a $2.5 million extortion racket by targeting a single government family unless he was being fed that target by someone else? Think about what that data actually enables: blackmail, operational access, and long-term leverage over people who hold security clearances. This is not random. This is a classic intelligence technique: compromise a mass of identities to mask the targeted extraction of a few high-value individuals. The $495,000 Moucka personally pocketed is pocket change — the real payload was the dossier on the government officer and his relatives. The plea deal seals his mouth. The question no one in the mainstream press will ask is: who handed him that specific file? Follow the thread to the agencies that manage the Snowflake infrastructure. They will tell you it was a "security incident." I'm telling you it was a data harvest with a clean exit strategy.

The Sentencing as a Signal: No Coincidences

Mark the date: October 27. This sentencing will happen just as the U.S. government enters budget negotiations and the next round of cyber-defense appropriations. That is not a coincidence. This is the architecture of consent in action: a "brave" hacker gets a dramatic prison term, Congress gets a reason to funnel billions more into "cybersecurity" programs, and the public is told the threat came from a single Canadian kid. Meanwhile, the real infrastructure of mass data collection — the software-as-a-service providers, the telcos, the financial networks that hoover up your Social Security number and driver's license — remains unregulated, unaccountable, and deeply embedded in the same intelligence networks that "investigated" this case. Moucka is a scapegoat. The guilty plea is a stage exit. The data is already in the hands of people who do not need to hack it. They own the cloud. They own the judge. And they are counting on you to forget his name by November.