U.S. soldier sentenced to 70 months over telecom data theft and extortion

What happened

Cameron John Wagenius, 22, a U.S. Army soldier stationed in South Korea, was sentenced on 25 September 2026 to 70 months in federal prison and ordered to pay $294,978 in restitution [1]. He had pleaded guilty to all counts in two federal indictments connected to intrusions at multiple telecommunications companies and the theft of mobile call and text metadata for more than 100 million AT&T customers in 2024 [1].

Wagenius operated under the handle Kiberphant0m. Working with three alleged co-conspirators, he downloaded data from several large customers of the cloud data platform Snowflake whose credentials were exposed and who did not enforce multi-factor authentication [1]. Snowflake has since made MFA mandatory on all accounts [1]. This was not an exploit of a product vulnerability — the accounts simply had no second factor.

In October 2024, Kiberphant0m posted on cybercrime forums claiming theft of call and text metadata — source and destination numbers, timestamps, call duration and similar fields — for tens of millions of AT&T customers, and claimed intrusions at more than a dozen telecoms worldwide including Verizon’s Push-to-Talk business [1]. The group extorted victims publicly in exchange for not publishing the data. AT&T paid the group a $370,000 Bitcoin ransom; immediately after co-conspirator Conor Moucka’s arrest, Kiberphant0m published files he said were AT&T call records belonging to Donald Trump and Kamala Harris, then President-elect and Vice President respectively, along with schematics he attributed to the NSA [1]. The source does not state whether those claims were ever independently verified.

Who is affected

The largest identified victim population is AT&T mobile customers — more than 100 million people whose call and text metadata was taken [1]. Verizon’s Push-to-Talk business is also named [1]. Kiberphant0m claimed more than a dozen telecom victims globally, but the reporting does not list them, so the full affected set is not public.

More broadly, any organisation that held data in a Snowflake tenant with password-only authentication during 2024 falls in the same exposure class. Access here came from exposed credentials against accounts that did not enforce MFA, not from a flaw in Snowflake itself [1]. The reporting does not say how the credentials were obtained.

Call and text metadata is not message content, but it is highly sensitive: who contacted whom, when, and for how long. For anyone whose contact patterns are themselves confidential — journalists, sources, people under protective arrangements — metadata exposure is the breach.

How it worked

The pattern is straightforward and repeatable: use exposed credentials against cloud data warehouses where no second factor blocks the login, bulk-export whatever the account can read, then extort the data owner [1]. Financially it worked poorly — the government’s sentencing memo puts Wagenius’s total earnings from selling stolen data at roughly $1,500 [1], against the $370,000 paid by AT&T.

The case also documents an unusual post-arrest detail. While in custody awaiting sentencing, Wagenius used other inmates’ email accounts to ask outside recipients to query commercial AI tools on his behalf — asking for Windows 10 Enterprise privilege escalation CVEs with working exploit code, and for step-by-step exploitation of CVE-2023-45208 [1]. That CVE is a command injection in the parsing_xml_stasurvey function of libcgifunc.so on the D-Link DAP-X1860 repeater, versions 1.00 through 1.01b05-01, which lets an attacker within radio range run shell commands as root during the repeater’s setup process by way of a crafted SSID. It carries a CVSS score of 8.8 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

He framed several of the requests as research for a book he was writing — framing prosecutors characterised as a way to get around AI tools’ refusal to output exploit code [1]. He also asked about improvising an antenna from commissary items and about escaping prison [1]. The government told the court it is unaware of evidence that he worked out how to use any of this against Bureau of Prisons systems, and when questioned Wagenius said he was researching vulnerabilities in order to report them to the BOP [1].

Case status

Kenneth Schuchman, 28, of Vancouver, Washington — who pleaded guilty in 2019 to operating the Satori IoT botnet — is described by prosecutors as having assisted the extortion of victim companies [1]. Conor Riley Moucka (“Judische”) of Kitchener, Ontario was arrested in 2024 and pleaded guilty in August 2026 [1]. John Erin Binns, an American living in Turkey, is still facing charges and is also wanted over a 2021 T-Mobile breach affecting at least 76 million customers [1].

What to do

• Enforce MFA on every cloud data warehouse, BI and ETL account, including service and machine identities. Password-only access to a bulk data store is the whole story in this case.
• Audit Snowflake and equivalent platforms for long-lived credentials, keys in code repositories, and accounts exempted from MFA policy. Rotate anything that predates your current policy.
• Alert on bulk export volume and on logins from new networks, not just on failed authentication. The theft here looked like a legitimate query session.
• Cap what a single credential can read. Row and column scoping on telecom metadata tables limits the blast radius of one stolen password.
• If you run D-Link DAP-X1860 repeaters on firmware 1.00 through 1.01b05-01, check for vendor firmware addressing CVE-2023-45208 and apply it if available; if none is available, avoid running setup mode in untrusted radio environments or retire the device. The vulnerability gives root to anyone in range via a crafted SSID during setup.
• Treat privileged insiders with data-platform access as an access-control problem, not a trust problem: session recording, joint approval for bulk export, and review of egress.
• If you provide commercial AI tooling in a regulated or custodial environment, assume benign-sounding framing will be used to extract operational exploit detail, and log prompts accordingly.