Connor Riley Moucka, one of the principal hackers behind the sweeping 2024 Snowflake customer breach campaign, pleaded guilty in Seattle federal court on Wednesday to charges including computer fraud, wire fraud, aggravated identity theft, and a related conspiracy. The plea follows his arrest in Canada in October 2024 and subsequent extradition to the United States.
The intrusions — carried out by Moucka and co-conspirator John Binns — reached at least 165 organizations and exposed records belonging to at least 100 million people, making the campaign one of the largest data breach operations in history.
The 2024 Snowflake Breach Campaign
The attack targeted Snowflake, the cloud data warehousing platform widely used by enterprises to store large-scale analytics data. Critically, the attackers did not compromise Snowflake's platform itself — instead they exploited a far more common and persistent vulnerability: credential reuse.
Using credentials obtained from infostealer malware that had infected the personal and work computers of Snowflake customer employees, Moucka and his co-conspirators used credential stuffing to authenticate directly to Snowflake customer accounts. Because many of these accounts lacked multi-factor authentication (MFA), the stolen credentials were sufficient to gain full access.
How the Attack Worked
1. Infostealer malware (e.g., Redline, Vidar) had previously stolen credentials
from employee devices — often harvested years before the campaign began
2. Attackers sourced bulk credential logs from underground markets
containing Snowflake employee/customer logins
3. Automated credential stuffing tools tested the stolen credentials
against Snowflake's customer tenants
4. Accounts without MFA were accessed using only the stolen username/password
5. Attackers exfiltrated bulk data from the compromised Snowflake tenants
6. Stolen data was offered for sale or used for extortion against the breached organizationsScale and Known Victims
The breadth of the campaign was extraordinary:
| Metric | Value |
|---|---|
| Organizations breached | 165+ |
| People affected | 100 million+ |
| Attack method | Credential stuffing via infostealer-harvested credentials |
| Authentication bypass | Accounts lacking MFA |
Several high-profile organizations were among the breach victims, including Ticketmaster (whose parent company Live Nation confirmed a breach affecting 560 million customers), Santander Bank, Advance Auto Parts, and multiple others. Ticketmaster's data — including names, addresses, partial payment card details, and event ticketing information — was offered for sale on underground forums for $500,000.
Charges and Guilty Plea
Moucka pleaded guilty to:
- Computer fraud (unauthorized access to protected computers)
- Wire fraud (transmitting fraudulent communications in furtherance of the scheme)
- Aggravated identity theft (use of stolen identity information during a felony)
- Related conspiracy charges
His co-conspirator John Binns — also indicted in connection with the Snowflake campaign — faces separate proceedings.
The guilty plea in Seattle federal court marks a significant step toward accountability for what prosecutors have described as a coordinated, large-scale criminal enterprise targeting cloud infrastructure at a massive scale.
Why This Matters: Credential-Stuffing as a Primary Attack Vector
The Snowflake campaign underscores a persistent and growing threat: infostealer malware harvests credentials from infected devices, and those credentials often circulate in underground markets for months or years before being weaponized. Many organizations believe they are protected because they haven't had a direct breach — but if their employees' credentials were ever captured by infostealer malware, those credentials may already be available to attackers.
Key lessons from the Snowflake campaign:
| Lesson | Action |
|---|---|
| MFA is non-negotiable for SaaS platforms | Enforce MFA on all cloud service accounts, especially those holding sensitive data |
| Infostealer exposure is a breach precursor | Monitor for employee credentials appearing in infostealer logs (via threat intelligence services) |
| Cloud data stores are high-value targets | Apply strict access controls, IP allowlisting, and session policies to cloud data platforms |
| Credential reuse creates cascading risk | Enforce unique, complex passwords; use a password manager; monitor for reused credentials |
| Audit third-party SaaS access regularly | Review who has access to Snowflake (and similar platforms) and remove stale accounts |
Snowflake's Response and Platform Changes
Following the breach campaign, Snowflake implemented platform-level changes to reduce exposure:
- MFA enforcement: Snowflake now supports and strongly recommends mandatory MFA for all customer accounts
- Session policies: Enhanced controls over session duration and network access
- Threat notifications: Improved alerting for suspicious login patterns consistent with credential stuffing
Organizations using Snowflake should review their current authentication configurations to ensure these protections are enabled.
Key Takeaways
- Connor Riley Moucka pleaded guilty on August 6, 2026 to charges stemming from the 2024 Snowflake breach campaign
- The campaign breached 165+ organizations and exposed data belonging to 100 million+ people
- Attack vector: credential stuffing using infostealer-harvested credentials against accounts lacking MFA
- The case highlights the long tail of infostealer campaigns — credentials stolen months or years earlier can enable future breaches
- Enforcing MFA on all cloud platforms remains the single most effective control against this class of attack