Between February and October 2024, Connor Riley Moucka and co-conspirators used stolen login credentials to access and steal data from at least 165 Snowflake customer accounts that did not enforce multi-factor authentication. The stolen data included billions of sensitive records such as non-content call and text history, financial information, government identifiers, and personally identifiable information. The group extorted victims by threatening to publish the stolen data, receiving over $2.5 million in ransom payments. Snowflake mitigated the issue by increasing password complexity requirements and enforcing multi-factor authentication on accounts. Moucka also engaged in re-extortion and harassment of government officials and security researchers. Co-conspirators include Cameron Wagenius, a U.S. Army soldier who pleaded guilty to similar extortion activities, and John Erin Binns, involved in a previous major breach. Moucka pleaded guilty to multiple criminal counts including computer fraud, wire fraud, aggravated identity theft, and conspiracy, facing up to 30 years in prison.

The unauthorized access and theft of sensitive data from over 165 organizations using Snowflake cloud services exposed billions of sensitive customer records, including personal identifiers, financial data, and call/text histories. The attackers extorted victims for ransom payments totaling over $2.5 million and engaged in re-extortion using stolen data. The breach affected major companies and government officials, causing significant privacy and security risks. The incident also involved harassment of officials and researchers. Snowflake's enforcement of multi-factor authentication and password complexity mitigated further exploitation via stolen credentials.

Snowflake has responded to the incident by increasing password complexity requirements and enforcing multi-factor authentication on customer accounts, which addresses the primary attack vector of stolen credentials without MFA. Organizations using Snowflake should ensure MFA is enabled and follow Snowflake's updated security recommendations. No additional vendor advisories or patches are indicated. Since this is a criminal case with guilty pleas, remediation focuses on prevention of similar credential-based attacks through strong authentication controls.