NewsPublished 5 Aug 2026

Canadian pleads guilty to Snowflake cloud data-theft attacks

Source Bleeping Computer

cloud

Description

A Canadian man pleaded guilty today to his role in accessing company accounts at cloud storage provider Snowflake and stealing data from at least 165 organizations in a scheme to extort millions of dollars from victims. [...]

Impact

The unauthorized access led to the theft of sensitive data from hundreds of millions of individuals and caused financial losses exceeding $9.5 million to victim companies. The attackers successfully extorted at least $2.5 million in bitcoin and obtained additional funds through selling stolen data. The breach exposed critical personal and financial information, increasing the risk of identity theft and further extortion. The attacks also included re-extortion attempts targeting government officers using stolen data.

Defensive guidance

Snowflake has implemented mandatory multi-factor authentication and requires passwords to be at least 14 characters long to prevent unauthorized access via stolen credentials. Organizations using Snowflake should ensure MFA is enabled on all accounts and enforce strong password policies. Since the attacks exploited accounts without MFA, enabling MFA is a critical defense. No additional vendor advisories or patches are indicated; the vendor manages remediation through these security policy changes.

Summary

Between February and October 2024, Connor Riley Moucka and an accomplice accessed Snowflake customer accounts lacking MFA by using stolen usernames and passwords obtained through infostealer malware. They extracted valuable information from cloud storage instances using custom software and stole data from at least 165 organizations, affecting over 100 million individuals. The stolen data included call/text history, banking information, payroll records, government registration numbers, and various forms of personally identifiable information. The attackers extorted victims for millions of dollars in bitcoin and sold stolen data on hacker forums. Following these breaches, Snowflake mandated MFA and minimum 14-character passwords for all accounts.

References

bleepingcomputer.com/news/security/canadian-pleads-guilty-to-snowflake-cloud-data-theft-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 5 Aug 2026, 21:56 UTC

References

Community reviews

Related threats