DOJ confirms US Army soldier arrested is linked to AT&T and Verizon hacks

US prosecutors have formally linked the arrest of a US Army soldier in December to a massive theft of US phone records by AT&T and Verizon last year.

Authorities arrested Cameron John Wagenius, a US Army communications specialist, in Texas on December 20 after a brief two-page grand jury indictment charging the US server with two counts of illegally transferring confidential telephone records. Wagenius was later extradited to Washington state.

In a new court hearing on Friday, US prosecutors confirmed that the charges against Wagenius are linked to the previous indictment of two alleged hackers, Connor Moucka and John Binns, who the US government is charging. multiple intrusions at cloud computing company Snowflake who saw the mass-theft of data stored in their customer accounts. Snowflake customers whose data was stolen include AT&T, which had “almost all” customer call records up to 2024 exfiltrated from its Snowflake account, and Verizon, from which a substantial cache was taken of customer call logs.

US Attorney Tessa Gorman he told the Seattle court that, “both cases arise from the same computer intrusion and extortion and include some of the same stolen victim information,” and as such, “these cases rely on overlapping evidentiary and legal process and undoubtedly present common questions of law and fact.”

This is the first public acknowledgment by prosecutors that Wagenius’ charges are connected to last year’s breaches at cloud computing company Snowflake. Security reporter Brian Krebs first report on the link between Wagenius and the Snowflake pirates in November, and then he made the news of the arrest of Wagenius.

The hacking of Snowflake accounts has become one of the most widespread cyberattacks of the past year, affecting AT&T, LendingTree, Santander Bank, Ticketmasterand at least 160 other companies. The hackers allegedly stole huge banks of personally identifiable and sensitive corporate data that companies stored on Snowflake, in part from using passwords stolen from employees’ computers with malware. Most of the affected Snowflake customers did not use multi-factor protection, which Snowflake did not require its customers to do at the time.

According to the report of Krebs, after the Moucka’s earlier arrest by Canadian authoritiesWagenius said in a post on a forum that cybercriminals are known to have access to the call logs of Vice President Kamala Harris and President-elect Donald Trump, and threatened to delete all stolen files unless Moucka was released.

Prosecutors accuse the Snowflake hackers of stealing data that included personal information, cell phone and IMEI numbers, dates of birth, postal and email addresses, passwords, Social Security numbers, government-issued ID numbers, and social security numbers. payment and bank account cards.

Wagenius was ordered on January 8 to be arrested, and is understood to be in custody in Washington state.