A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata belonging to more than 100 million AT&T customers was sentenced to 70 months in federal prison. In addition to the prison term handed down in a Seattle federal courtroom, the defendant was ordered to pay nearly $300,000 in restitution to his victims, concluding a high-profile cybercrime case that exposed significant vulnerabilities in modern cloud data storage security and rattled national security agencies.
Cameron John Wagenius, a 22-year-old soldier stationed at a U.S. Army base in South Korea at the time of his offenses, operated under the notorious cybercriminal persona "Kiberphant0m." Operating alongside a network of alleged co-conspirators, Wagenius exploited unsecured digital entry points to breach major corporate clients using the cloud data storage service Snowflake. These targeted accounts had suffered from exposed credentials and failed to enforce multi-factor authentication, a security lapse that has since prompted Snowflake to mandate multi-factor authentication across all customer accounts.
By October 2024, Kiberphant0m was openly boasting on dark-web and cybercrime forums about having successfully downloaded the call and text metadata—including source and destination numbers, precise timestamps, and call durations—for tens of millions of AT&T customers. Investigators revealed that Wagenius claimed to have compromised more than a dozen telecommunications companies worldwide, including Verizon’s specialized Push-to-Talk business. The threat actor attempted to publicly extort these massive corporations, demanding substantial payouts under the threat of publishing the sensitive customer records online.
The breakthrough in identifying the elusive hacker came in late November 2024, when cybersecurity journalist Brian Krebs published reports warning that the individual operating as Kiberphant0m was likely an active-duty U.S. soldier stationed in South Korea. Less than a month after those investigative reports surfaced, Wagenius was apprehended by federal authorities. He was subsequently charged in two separate federal indictments and quickly entered guilty pleas to all counts across both cases, accepting responsibility for his role in the sweeping conspiracy.
Federal prosecutors outlined that Wagenius did not operate in a vacuum, detailing a wider web of digital conspirators. Among them was Kenneth Schuchman, a 28-year-old resident of Vancouver, Washington, with a long history of illicit cyber activities. Schuchman had previously made headlines in 2019 when he pleaded guilty to operating the Satori botnet, a vast, automated collection of hijacked Internet-of-Things devices that had been weaponized to launch devastating, large-scale distributed denial-of-service attacks against critical internet infrastructure.
Other alleged co-conspirators tied to the Snowflake data theft wave faced parallel legal actions. Conor Riley Moucka, operating under the online handle "Judische" from Kitchener, Ontario, was arrested in 2024 and subsequently pleaded guilty in August 2026. Meanwhile, John Erin Binns, an American citizen currently residing in Turkey, remained wanted by law enforcement for his suspected involvement in a massive 2021 data breach at T-Mobile that exposed the personal identifying information of at least 76 million customers.
As the extortion scheme escalated, Wagenius and his associates engaged in increasingly brazen and desperate tactics, including the re-extortion of victim companies even after money had changed hands. Shortly after Moucka was arrested—and after AT&T had already transferred a $370,000 Bitcoin ransom to the extortion group—Kiberphant0m retaliated by publishing what he claimed were AT&T call logs belonging to prominent political figures, including then-President-elect Donald Trump and then-Vice President Kamala Harris. To maximize pressure on authorities and corporate targets, the hacker also leaked documents and schematics allegedly stolen from the U.S. National Security Agency.
The involvement of an active-duty soldier holding a secret security clearance triggered an immediate and coordinated multi-agency federal response. Paul Russell, a resident agent in charge at the Defense Criminal Investigative Service, the criminal investigative arm of the U.S. Department of Defense Office of Inspector General, explained the gravity of the situation. When DCIS received intelligence pointing to an insider threat with high-level clearance engaging in cybercrime and extortion, the agency mobilized alongside the Federal Bureau of Investigation, the Army Criminal Investigative Division, and the U.S. Secret Service.
"We don’t often get leads where there’s an active duty soldier with a secret clearance who’s creating hacking tools and trafficking in data," Russell noted, reflecting on the unusual and alarming nature of the case. "That doesn’t happen every day, and so when that hits it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with."
Even while incarcerated and awaiting his sentencing hearing, Wagenius continued to test the boundaries of digital security, drawing renewed scrutiny from federal prosecutors. According to a sentencing memo filed by prosecutors in Seattle, Wagenius violated computer use policies within the Bureau of Prisons as he attempted to probe and map out vulnerabilities within the prison system’s internal computer networks.
Investigators discovered that in September 2025, Wagenius utilized another inmate’s email system to prompt a commercial artificial intelligence tool to supply technical details regarding privilege escalation vulnerabilities and bypass methods for Windows 10 Enterprise. The records showed that the incarcerated hacker specifically asked for real-world working scripts for specific common vulnerabilities and exposures without omitting any code. Days later, through a different inmate’s account, Wagenius sought detailed step-by-step instructions and potential exploit code for a command-injection vulnerability affecting D-Link networking devices.
Further investigation into his prison communications revealed that Wagenius also sought instructions on how to construct a makeshift radio antenna using commissary items and everyday prison tools to extend reception, alongside queries regarding prison escape methods. When confronted by authorities regarding these suspicious inquiries, Wagenius claimed he was merely researching potential software flaws to supply information back to the Bureau of Prisons, attempting to frame his AI prompts as background research for a book he was writing. Prosecutors pointed out that this strategy mirrored prompt injection techniques designed to bypass safety filters built into commercial artificial intelligence models.
Despite the monumental scale of data exfiltrated from AT&T and other telecommunications giants, financial forensic analysis revealed that the enterprise was remarkably unprofitable for its main perpetrator. Court documents disclosed that across all of his extensive hacking and extortion efforts, Wagenius managed to net a total of only about $1,500 from selling stolen data.
"While Wagenius was not particularly financially successful as a cybercriminal, he both intended to and caused significant harm to numerous individual victims, U.S. companies, and the U.S. government," the sentencing memo stated, summarizing the severe real-world consequences that ultimately secured his nearly six-year federal prison sentence and mandatory financial restitution.
Comments (0)