U.S. Soldier Sentenced to 70 Months for Telecom Data Theft and Extortion
Summary
Cameron Wagenius, a U.S. soldier who pleaded guilty to hacking telecom companies and extorting victims, was sentenced to 70 months in prison and ordered to pay nearly $295,000 in restitution.
Key points
- Wagenius, who used the alias “Kiberphant0m,” stole mobile call and text metadata affecting more than 100 million AT&T customers and claimed to have targeted other telecom companies.
- He and alleged co-conspirators accessed Snowflake customer data using exposed credentials on accounts that did not require multifactor authentication; Snowflake has since mandated MFA.
- Wagenius pleaded guilty and was sentenced to 70 months in federal prison, with $294,978 in restitution ordered.
- The article says an AT&T ransom payment of $370,000 had already been made, but Wagenius personally earned about $1,500 from selling stolen data.
- Two alleged co-conspirators faced charges related to the Snowflake data thefts; one had pleaded guilty, while the other was wanted in connection with a separate T-Mobile breach.
- While awaiting sentencing, Wagenius sought AI-generated information about vulnerabilities in Bureau of Prisons systems, but prosecutors said they had no evidence he learned to use or deploy them.
Article Details
- Event Type
- A U.S. Army soldier was sentenced after pleading guilty to hacking telecommunications companies, stealing customer data, and extortion.
- Impact
- The stolen data included call and text metadata for more than 100 million AT&T customers. Prosecutors said the conduct harmed individuals, U.S. companies, and the U.S. government. Wagenius was sentenced to 70 months in prison and ordered to pay $294,978 in restitution; the article says his extortion efforts were largely unsuccessful.
CVE
People
Cameron John WageniusU.S. Army soldier who pleaded guilty to hacking telecommunications companies, stealing data, and extortion; sentenced to 70 months in prison.Conor Riley MouckaNamed as an alleged co-conspirator in the Snowflake data thefts; arrested in 2024 and pleaded guilty in August 2026.John Erin BinnsNamed as an alleged co-conspirator in the Snowflake data thefts; also wanted in connection with a 2021 T-Mobile data breach.Kenneth SchuchmanProsecutors said he assisted Wagenius's extortion efforts; he previously pleaded guilty to operating the Satori botnet.Paul RussellDefense Criminal Investigative Service resident agent in charge who described the investigation.
Threat Actors
Cameron John WageniusIdentified as the person behind the Kiberphant0m persona; pleaded guilty to hacking telecommunications companies, stealing data, and extortion.Conor Riley MouckaNamed as an alleged co-conspirator in Snowflake data thefts; pleaded guilty in August 2026.John Erin BinnsNamed as an alleged co-conspirator in the Snowflake data thefts and wanted in connection with a 2021 T-Mobile data breach.JudischeAlias explicitly identified in the article for Conor Riley Moucka, who was named as an alleged co-conspirator in Snowflake data thefts.Kenneth SchuchmanProsecutors said he assisted Wagenius's extortion efforts; previously pleaded guilty to operating the Satori botnet.kiberphant0mCybercriminal persona adopted by Cameron John Wagenius; used in hacking, data theft, and extortion activity.
Malware
Vendors
AT&Tmultiple telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024 was sentenced to 70 months in federal prison today and ordered to pay nearly $300,000 inSnowflakeKiberphant0m downloaded data from several large customers of the cloud data storage service Snowflake that had exposed credentials and did not enforce multi-factor authentication (Snowflake has sinceVerizonclaimed to have hacked into more than dozen telecommunications companies worldwide, including Verizon’s Push-to-Talk business, and publicly extorted these companies in exchange for a promise not to publish
Products
Countries
South KoreaArmy base in South Korea when he adopted the cybercriminal persona “Kiberphant0m.” Working with three alleged co-conspirators, Kiberphant0m downloaded data from several large customers of the cloud data storage serviceTurkeyin 2024 and pleaded guilty in August 2026; and John Erin Binns, an American man currently living in Turkey who is also wanted for a 2021 data breach at T-Mobile that exposed the personal information of at least