Reported by 7 outlets
Former US soldier sentenced for telecom hacking and extortion spree
Why this score
- Breadth
- 2.00 / 2.0 · 7 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Cameron John Wagenius, the 22-year-old former Army soldier who ran the persona kiberphant0m, was sentenced September 25 to 70 months in federal prison and ordered to pay $294,978 in restitution. Working with alleged co-conspirators including Connor Moucka, he stole call and text metadata for more than 100 million AT&T customers in 2024 by downloading data from Snowflake customer environments that had exposed credentials and no MFA enforcement, a pattern that also hit other large cloud data holders. He bragged about hacking over a dozen telecom firms including Verizon's Push-to-Talk business and extorted companies publicly for silence.
Court documents describe activity from April 2023 to December 2024, while Wagenius was on active duty. The group used the SSH Brute tool he helped develop to harvest credentials, coordinated on Telegram, and extorted at least 10 organizations for a combined target above $1 million, including repeated attempts to squeeze $500,000 from AT&T. Wagenius leaked the call detail records of a government official and family members of another former official, and per DOJ attempted to sell stolen sensitive data to a foreign intelligence service while researching defection to Russia. He pleaded guilty in February and July 2025 after his December 2024 arrest in Texas.
The sentence closes the operational chapter of the Snowflake spree but confirms its scale: insider-enabled tooling, cloud environments without MFA, and telecom metadata as an extortion product. Watch for cases against the remaining co-conspirators, civil or regulatory fallout for the victims that lagged on MFA, and whether the intelligence-selling allegation gets elaborated in future filings.
Timeline
-
original reporting
(justice.gov) Former U.S. Soldier Sentenced for Multi-Year Cybercrime Spree Involving Telecommunications Hacking and Extortion In brief - Th
www.justice.gov · 18d ago · September 25th, 2026
(justice.gov) Former U.S. Soldier Sentenced for Multi-Year Cybercrime Spree Involving Telecommunications Hacking and Extortion In brief - Th
via Mastodon https://www.justice.gov/opa/pr/former-us-soldier-sentenced-hacking-and-extortion-scheme-exposed-sensitive-data-us
-
update from krebsonsecurity.com
Crooks Steal Phone, SMS Records for Nearly All AT&T Customers
krebsonsecurity.com · 824d ago · July 12th, 2024
First coverage of the AT&T disclosure: in an SEC filing the same day, AT&T said call and text metadata for roughly 110 million people was accessed in April 2024 from an AT&T workspace on a third-party cloud platform (Snowflake) protected by username and password only, with no MFA. The records covered May 1 to Oct. 31, 2022 and Jan. 2, 2023, and a subset included cell-tower identifiers that could approximate device location. AT&T learned of the breach April 19, 2024 and delayed disclosure at the FBI's request; TechCrunch tied the theft to a breach affecting more than 160 Snowflake customers.
-
update from krebsonsecurity.com
Hacker in Snowflake Extortions May Be a U.S. Soldier
krebsonsecurity.com · 687d ago · November 26th, 2024
KrebsOnSecurity reported that Kiberphant0m, the handle selling data stolen from Snowflake customers and publicly extorting AT&T and Verizon, appeared to be a U.S. Army soldier stationed in South Korea, based on chat records reviewed with Flashpoint, Intel 471, and Unit 221B. After co-conspirator Connor Riley Moucka's Oct. 30, 2024 arrest, Kiberphant0m posted claimed AT&T call logs for Donald Trump and Kamala Harris plus an NSA 'data schema', offered Verizon push-to-talk call logs on Nov. 5, and advertised a SIM-swapping service on Nov.
-
update from krebsonsecurity.com
U.S. Army Soldier Arrested in AT&T, Verizon Extortions
krebsonsecurity.com · 653d ago · December 30th, 2024
Federal authorities arrested Cameron John Wagenius, 20, near Fort Hood, Texas on Dec. 20, 2024 on a two-count indictment for unlawful transfer of confidential phone records; the case was later transferred to the Western District of Washington. KrebsOnSecurity identified him as Kiberphant0m, a communications specialist recently stationed in South Korea who claimed intrusions into at least 15 telecommunications firms. Unit 221B chief research officer Allison Nixon said the opsec mistake that unmasked him was found Nov. 10 and his last Telegram activity was Dec.
-
update from justice.gov
Former U.S. Soldier Pleads Guilty to Hacking and Extortion Scheme Involving Telecommunications Companies
justice.gov · 456d ago · July 15th, 2025
DOJ announced Wagenius pleaded guilty to conspiracy to commit wire fraud, extortion in relation to computer fraud, and aggravated identity theft. Court documents say that between April 2023 and Dec. 18, 2024 he used the kiberphant0m nickname to defraud at least 10 victim organizations, obtaining credentials with a tool called SSH Brute and moving them via Telegram, then extorting victims on BreachForums and XSS.is for at least $1 million while on active duty.
-
update from cyberscoop.com
Army soldier sentenced for spree of attacks on AT&T, Snowflake and other major companies
cyberscoop.com · 18d ago · September 25th, 2026
A former Army soldier responsible for a series of attacks and extortion attempts on telecom companies, including AT&T, was sentenced to 70 months in prison , the Justice Department said Friday. Prior to his arrest in December 2024, Wagenius attempted to sell stolen sensitive data to a foreign intelligence service and sought information online about defecting to Russia. “Cameron Wagenius spent more than a year and a half betraying the trust placed in him as an active duty soldier by carrying out a sweeping cybercrime campaign,” said A. Tysen Duva, assistant attorney general of the Justice Department’s Criminal Division, said in a statement. Wagenius, who pleaded guilty in July 2025, leaked stolen call records of President Donald Trump as part of multiple failed attempts to extort $500,000 from AT&T, Allison Nixon, chief research officer at Unit 221B, previously told CyberScoop. Authorities did not name Wagenius’ alleged victims in court filings, but said he disclosed non-content call detail records belonging to a government official and family members of another former official. AT&T in July confirmed cybercriminals accessed the company’s Snowflake environment in April and stole six months of phone and text records of “nearly all” of its customers .
-
update from krebsonsecurity.com
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
krebsonsecurity.com · 18d ago · September 25th, 2026
One of several selfies from the Facebook page of Cameron Wagenius. Army base in South Korea when he adopted the cybercriminal persona “ Kiberphant0m .” Working with three alleged co-conspirators, Kiberphant0m downloaded data from several large customers of the cloud data storage service Snowflake that had exposed credentials and did not enforce multi-factor authentication (Snowflake has since mandated MFA on all accounts). source and destination number, timestamp, duration, etc.) for tens of millions of AT&T customers. Kiberphant0m claimed to have hacked into more than dozen telecommunications companies worldwide, including Verizon’s Push-to-Talk business, and publicly extorted these companies in exchange for a promise not to publish the stolen data. In late November 2025, KrebsOnSecurity warned that Kiberphant0m was likely a U.S. Less than a month later, Wagenius was arrested and charged in two separate federal indictments, and soon pleaded guilty to all counts in both cases. At his sen
-
mentioned by malware.news
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
malware.news · 18d ago · September 25th, 2026
-
mentioned by krebsonsecurity.com
(krebsonsecurity.com) U.S. Army Soldier Sentenced for Massive Telecom Data Breach and Extortion Scheme Involving Snowflake Credential Theft
krebsonsecurity.com · 18d ago · September 25th, 2026
-
update from krebsonsecurity.com
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions https:// krebsonsecurity.com/2026/09/u- s-soldier-gets-70-months-in-priso
krebsonsecurity.com · 18d ago · September 25th, 2026
Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions https:// krebsonsecurity.com/2026/09/u- s-soldier-gets-70-months-in-priso
via Mastodon https://krebsonsecurity.com/2026/09/u-s-soldier-gets-70-months-in-prison-for-att-verizon-extortions/
-
mentioned by krebsonsecurity.com
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions https:// krebsonsecurity.com/2026/09/u- s-soldier-gets-70-months-in-priso
krebsonsecurity.com · 17d ago · September 26th, 2026
-
mentioned by krebsonsecurity.com
U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions Source: Krebs on Security Read: https:// krebsonsecurity.com/2026/09/u- s
krebsonsecurity.com · 17d ago · September 26th, 2026
-
update from krebsonsecurity.com
Meanwhile, corporate robbers and wrecking balls continue their "security" forays with impunity. If you missed this: KrebsonSecurity: U.S. So
krebsonsecurity.com · 17d ago · September 26th, 2026
Meanwhile, corporate robbers and wrecking balls continue their "security" forays with impunity. If you missed this: KrebsonSecurity: U.S.
-
mentioned by krebsonsecurity.com
US Soldier Gets 70 Months in Prison for AT&T, # Verizon Extortions https:// krebsonsecurity.com/2026/09/u- s-soldier-gets-70-months-in-priso
krebsonsecurity.com · 17d ago · September 26th, 2026
-
update from bleepingcomputer.com
US soldier gets 70 months in prison for extorting 10 tech, telecom firms
bleepingcomputer.com · 15d ago · September 28th, 2026
Army, Wagenius and his accomplices stole login credentials for the victim's networks using the SSH Brute hacking tool he helped develop. "In other instances, conspirators offered to sell stolen data for thousands of dollars via posts on these forums. They successfully sold at least some of this stolen data and also used stolen data to perpetuate other frauds, including SIM-swapping.
-
mentioned by www.bleepingcomputer.com
US soldier gets 70 months in prison for extorting 10 tech, telecom firms https:// bleepingcomputer.com/news/security/ us-soldier-gets-70-mon
www.bleepingcomputer.com · 15d ago · September 28th, 2026
-
update from securityweek.com
Prison Sentence for Former US Soldier Who Hacked AT&T and Verizon
securityweek.com · 15d ago · September 28th, 2026
The individual, Cameron John Wagenius, 22, a former Army soldier, allegedly hacked into wireless carriers’ databases to retrieve sensitive information and extort the victims, documents presented in court show. In February 2025, he admitted in court to sharing confidential phone records, and in J
-
mentioned by malware.news
Former U.S. Soldier Sentenced for Hacking and Extortion Scheme That Exposed Sensitive Data of U.S. Government Official
malware.news · 15d ago · September 28th, 2026
-
update from www.theregister.com
Active-duty soldier hacked telecoms, stole records, tried extorting over $1 million. Got 70 months in prison. Sometimes the easiest hack is
www.theregister.com · 14d ago · September 29th, 2026
Got 70 months in prison. Sometimes the easiest hack is
via Mastodon https://www.theregister.com/cyber-crime/2026/09/28/ex-soldiers-telecom-hacking-spree-earns-him-70-months/5299440