Cameron John Wagenius, a former US Army soldier, pleaded guilty to his role in a hack that affected AT&T and Verizon and resulted in the theft of data from well over 100 million customers of the companies, according to TechCrunch. Wagenius, a 20-year-old stationed in Texas, copped to two counts of “unlawful transfer of confidential phone records information” and will face a fine of up to $250,000 and up to 10 years in prison for each of the charges.
Wagenius was taken into custody last year after being indicted for his alleged role in a hack of the two major wireless carriers. AT&T reported that the breach allowed the hacker to access “nearly all” of its customers’ phone records, including histories of calls and texts made by its users, over a six-month period in 2022. More than 110 million were notified of the breach because their data was impacted. Verizon similarly reported that it had a significant collection of customer call logs stolen.
Both of the hacks that involved Wagenius are believed to be related to Snowflake, a cloud services and data analytics provider. It’s believed that Wagenius and his alleged accomplices were able to access data from AT&T, Verizon, and more than 160 other companies including Ticketmaster and LendingTree through unprotected accounts that had access to Snowflake customer accounts. Prosecutors allege that the hackers were able to access everything from social security numbers and driver’s license numbers to passport details and banking information.
Two other people have also been indicted about the Snowflake hack: Connor Moucka and John Binns. According to the Justice Department, the two were able to steal “billions of sensitive customer records,” and successfully used that access to extort three victims, who ultimately paid at least 36 bitcoin (valued at $2.5 million at the time of payment) to the hackers. Their extortion campaign ran from November 2023 to October 2024, shortly before they were ultimately charged and arrested.
Moucka, who lives in Canada, didn’t exactly shy away from discussing his role in the hack. He was in communication with 404 Media leading up to his arrest and told the publication believed law enforcement was after him. Binns, an American who was living in Turkey, also didn’t shy away from media. He took direct credit for the breach of AT&T in an interview with the Wall Street Journal.
Wagenius, by comparison, was a little more press-shy—but apparently didn’t have the strongest OPSEC, as investigators like Brian Krebs were able to pinpoint his identity based on forum posts and online activity.