Tag:

hack

U.S. Army Soldier Sentenced to Nearly Six Years in Prison for Massive Telecom Hack Involving AT&T and Snowflake Data Breaches

by admin September 26, 2026

written by admin

A federal court in Seattle has sentenced a 22-year-old active-duty U.S. Army soldier to 70 months in prison for orchestrating a sprawling international cybercrime and extortion campaign. Cameron John Wagenius, who operated under the alias "Kiberphant0m" while stationed at a military base in South Korea, pleaded guilty to multiple federal charges related to hacking into major telecommunications companies, stealing sensitive metadata from more than 100 million AT&T customers, and attempting to blackmail corporate victims. In addition to his prison term, Wagenius was ordered to pay $294,978 in restitution to his victims.

The sentencing brings a definitive legal close to a high-profile cyber espionage and extortion scheme that exposed critical vulnerabilities in cloud-storage ecosystems and telecom networks. Despite the monumental scale of the data he compromised—including call and text logs belonging to tens of millions of mobile users—prosecutors revealed that Wagenius netted a remarkably paltry sum of approximately $1,500 from his illicit data sales, highlighting a striking disjunction between the vast magnitude of the harm caused and the meager financial rewards realized by the perpetrator.

The Genesis of "Kiberphant0m": Cloud Vulnerabilities and Compromised Credentials

The sprawling conspiracy centered largely around widespread security oversights in cloud data storage services, most notably Snowflake. During his deployment in South Korea, Wagenius, holding a secret security clearance, adopted the moniker Kiberphant0m and aligned himself with an international syndicate of cybercriminals. This collective capitalized on exposed user credentials and a widespread failure across organizations to enforce multi-factor authentication (MFA). By exploiting these foundational security gaps, the group systematically breached multiple large enterprise accounts hosted on cloud platforms, downloading vast repositories of proprietary and customer data.

By October 2024, Kiberphant0m emerged as a public figure within underground cybercrime forums, openly boasting about his exploits. He claimed responsibility for infiltrating more than a dozen international telecommunications organizations, including Verizon’s specialized Push-to-Talk business. The core of his theft involved the extraction of massive volumes of telecommunications metadata—specifically source and destination numbers, time stamps, and call durations—for over 100 million AT&T subscribers.

Wagenius and his co-conspirators leveraged this stolen information to run an aggressive extortion campaign. They directly targeted the afflicted corporations, threatening to publicly leak the sensitive proprietary data and customer metadata unless exorbitant ransom demands were met.

A Chronology of Investigation, Identification, and Arrest

The unraveling of the Kiberphant0m persona represents a textbook example of collaborative digital forensics between investigative journalism and federal law enforcement agencies.

Late November 2024: Cybersecurity publication KrebsOnSecurity published an investigative report warning that the individual operating as Kiberphant0m was likely an active-duty U.S. soldier stationed on the Korean Peninsula.
December 2024: Law enforcement agencies swiftly acted on the public disclosures and internal leads. Cameron Wagenius was arrested and subsequently hit with two separate federal indictments. Confronted with overwhelming digital evidence, he quickly opted to plead guilty to all charges.
September 2025: While awaiting sentencing in federal detention, Wagenius was caught attempting to probe and compromise the computer network of the Bureau of Prisons (BOP), utilizing sophisticated prompt injection techniques against commercial artificial intelligence tools.
August 2026: Canadian co-conspirator Conor Riley Moucka pleaded guilty to his role in the Snowflake-related extortion campaigns.
Today: Wagenius receives his final sentence of 70 months in federal prison alongside nearly $300,000 in restitution during a hearing in Seattle.

An International Network of Co-Conspirators

Federal prosecutors emphasized that Wagenius did not act in a vacuum. He operated within a sophisticated ecosystem of seasoned cybercriminals. Chief among his alleged partners was Kenneth Schuchman, a 28-year-old resident of Vancouver, Washington, with a notorious background in digital crime. Schuchman previously pleaded guilty in 2019 to operating the Satori botnet—a massive, automated network of hijacked Internet-of-Things (IoT) devices responsible for crippling, large-scale distributed denial-of-service (DDoS) attacks.

Other central figures in the sweeping Snowflake-related data theft investigations include Conor Riley Moucka, operating under the alias "Judische," of Kitchener, Ontario, who was arrested in 2024 and formally entered a guilty plea in August 2026. Furthermore, American national John Erin Binns, residing in Turkey, remains wanted by authorities for his alleged participation in the monumental 2021 T-Mobile data breach, which compromised the personal information of at least 76 million consumers.

Escalation, Double-Crossing, and National Security Threat

As pressure mounted from international law enforcement, the extortion tactics employed by Kiberphant0m grew increasingly erratic and reckless. Following the initial arrest of Conor Moucka—and despite the fact that AT&T had already paid the extortion syndicate a $370,000 ransom in Bitcoin—Kiberphant0m engaged in a retaliatory double-cross.

In an effort to pressure victims and flaunt his reach, Wagenius published files on underground hacker forums that he claimed included call logs belonging to prominent political figures, specifically then-President-elect Donald Trump and then-Vice President Kamala Harris. More alarmingly, he threatened to leak classified documents and technical schematics allegedly stolen from the U.S. National Security Agency (NSA). This brazen pivot from corporate extortion to the reckless handling of national security secrets transformed the investigation from a corporate cybercrime case into a top-tier national security priority.

A Multi-Agency Response to an Unprecedented Insider Threat

The intersection of active-duty military service, active security clearances, and sophisticated cyberattacks triggered an immediate, high-priority response across the United States defense and law enforcement apparatus. Paul Russell, the resident agent in charge at the Defense Criminal Investigative Service (DCIS)—the criminal investigative arm of the Department of Defense Office of Inspector General—highlighted the atypical nature of the case.

According to Russell, when DCIS received actionable intelligence indicating that an active-duty soldier with a secret clearance was actively engineering hacking tools and trafficking in stolen data, the response was immediate. The agency launched a joint task force comprising the Federal Bureau of Investigation (FBI), the Army Criminal Investigation Division (CID), and the U.S. Secret Service.

"We don’t often get leads where there’s an active-duty soldier with a secret clearance who’s creating hacking tools and trafficking in data," Russell noted. "That doesn’t happen every day, and so when that hits, it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with."

In-Custody Misconduct and the Abuse of Artificial Intelligence

Details emerging from the federal sentencing memorandum filed by prosecutors in Seattle shed light on Wagenius’s persistent technical ambitions, even while incarcerated. While awaiting sentencing in Bureau of Prisons (BOP) facilities, Wagenius reportedly violated institutional computer use policies in a systematic effort to map out vulnerabilities within the prison system’s administrative network.

Records cited by the prosecution reveal that in September 2025, Wagenius utilized another inmate’s electronic messaging account to query commercial artificial intelligence systems. To bypass built-in safety controls designed to prevent the generation of malicious code, Wagenius employed "prompt injection"—a technique where deceptive contexts, such as claiming the queries were for a book he was writing, are used to trick AI models into outputting actionable exploitation material.

In one instance, Wagenius asked an AI tool to detail specific Common Vulnerabilities and Exposures (CVEs) related to Windows 10 Enterprise privilege escalation, demanding "a real world working script for each CVE . . . without omitted code." Shortly thereafter, he requested step-by-step instructions and potential code for CVE-2023-45208, a command injection vulnerability found in D-Link networking hardware. Furthermore, records show he sought instructions on constructing improvised radio antennas using prison commissary items to extend reception, alongside queries concerning prison escape strategies.

While prosecutors acknowledged there was no definitive evidence that Wagenius successfully deployed these researched vulnerabilities against BOP infrastructure, the attempted exploitation underscored his persistent technological threat profile. When questioned by authorities, Wagenius maintained that his research into potential system flaws was intended solely to assist the BOP in improving its security posture—an explanation prosecutors viewed with considerable skepticism.

Broader Implications for Corporate and National Security

The legal conclusion of the Cameron Wagenius case serves as a watershed moment for contemporary cybersecurity, underscoring systemic vulnerabilities across multiple vectors of modern digital infrastructure.

First, the incident exposed the fragile reliance on third-party cloud data storage ecosystems. The Snowflake breaches demonstrated how enterprise-level data repositories can be compromised simply through poor credential hygiene and the absence of mandatory multi-factor authentication. In the wake of these incidents, major cloud providers and enterprise vendors have aggressively moved toward mandatory MFA enforcement to mitigate credential-stuffing and unauthorized access vectors.

Second, the case highlights the evolving threat landscape posed by insider actors. The convergence of military-grade security clearances with advanced technical proficiency creates severe risks for national defense agencies. The ability of a single service member to exfiltrate massive datasets, traffic in sensitive metadata, and subsequently threaten national security disclosures forced defense and intelligence agencies to reevaluate internal monitoring, clearance vetting, and digital access controls.

Finally, the incident illustrates the growing risks associated with the misuse of generative artificial intelligence. Wagenius’s in-custody attempts to weaponize commercial AI models via prompt injection demonstrate how malicious actors can leverage large language models to automate the discovery of privilege escalation paths and exploit scripts, lowering the technical barrier to sophisticated cyber operations even from behind prison walls.

As Wagenius begins his nearly six-year federal prison sentence, the broader digital ecosystem continues to grapple with the long-term fallout of the Snowflake and AT&T breaches. Federal authorities maintain that while the financial yield of the operation was negligible, the widespread disruption, corporate expenditures, and national security implications justify the severe punitive measures handed down by the court.

September 26, 2026 0 comment

Cybersecurity & Hacking

OnTrac Notifies Customers of Data Breach Following Corporate Network Hack

by admin July 24, 2026

written by admin

OnTrac, a prominent American parcel delivery company, has publicly disclosed a significant data breach affecting its corporate network, potentially exposing personal details belonging to its extensive customer base. The revelation underscores the escalating cybersecurity threats faced by logistics firms, which handle vast amounts of sensitive consumer information. The company’s notification, while confirming access to customer names, has left other potentially compromised data elements undisclosed due to redaction in regulatory samples.

Chronology of the Cyberattack and Initial Response

The cyber incident was first detected on March 23, prompting an immediate internal investigation by OnTrac’s security teams. Forensic analysis subsequently revealed that unauthorized actors had gained access to specific files within the company’s corporate network over a period of three days, from March 20 to March 22. This narrow window of access suggests a targeted intrusion, where attackers swiftly navigated the network to locate and potentially exfiltrate data. The prompt detection and initiation of an investigation are critical steps in incident response, aiming to contain the breach and understand its full scope. However, the three-day window of unauthorized access highlights a period where customer data could have been at risk, necessitating a thorough forensic review.

Following the detection, OnTrac engaged a third-party cybersecurity specialist firm. This is a standard and recommended practice for companies experiencing sophisticated cyberattacks, as external experts bring specialized skills in forensic analysis, incident containment, and remediation that internal teams might lack. Their role is crucial in determining the exact nature of the breach, the methods used by the attackers, and, most importantly, precisely what data was accessed and potentially exfiltrated.

OnTrac’s Operational Footprint and Potential Scale of Impact

OnTrac operates as a private American parcel-delivery company, with a particular specialization in "last-mile" e-commerce deliveries—the final leg of a product’s journey to the consumer. The company was established in 2021 through the merger of OnTrac Logistics and LaserShip, creating a larger entity with an expanded operational reach. This merger likely integrated disparate IT systems and customer databases, potentially increasing the attack surface or creating complexities in securing a consolidated network.

The firm boasts an impressive operational scale, maintaining 102 locations across 35 states and collectively covering approximately 70% of the U.S. population. Its expansive network relies on a vast ecosystem, working with more than 7,000 independent delivery contractors. Given this extensive reach and reliance on a broad network of partners, the potential number of affected customers could be substantial. Each package processed, each delivery scheduled, and each customer interaction generates data that, if compromised, could lead to significant privacy concerns. The sheer volume of data handled by such a large logistics operation makes it an attractive target for cybercriminals seeking personal information for various malicious purposes, including identity theft and targeted phishing campaigns.

The Nature of Compromised Data and Unanswered Questions

OnTrac notifies customers of data breach after network hack

While OnTrac’s notification sample, shared with authorities, confirms that customer names were among the exposed data elements, the full extent of the compromised information remains unclear. The company redacted details regarding other types of data exposed in the publicly available notification. In similar data breaches within the logistics sector, "personal details" can encompass a wide range of sensitive information beyond names, including:

Physical addresses: Essential for parcel delivery, but also a key component for identity theft.
Email addresses and phone numbers: Used for communication regarding deliveries and often exploited for phishing scams.
Tracking information and delivery history: While seemingly innocuous, this can reveal patterns of consumer behavior or presence/absence from home, which could be exploited.
Account credentials: If customers had online accounts with OnTrac, usernames and hashed passwords could be at risk.
Limited payment information: Although less common in corporate network breaches compared to direct payment system compromises, some companies may store truncated payment card details or billing addresses.

Without a comprehensive disclosure of all data types, customers are left to speculate about the full extent of their risk. The lack of transparency, while sometimes legally permissible or strategically employed during an ongoing investigation, can heighten customer anxiety and hinder their ability to take appropriate protective measures. BleepingComputer, a cybersecurity news outlet, reached out to OnTrac for more details regarding the attack, the precise number of impacted clients, and whether a ransom was paid, but had not received a response by the time of publication.

Implications of "Re-secured and Not Distributed": A Possible Ransom Payment

A particularly notable statement from OnTrac’s notification indicates that the company took steps to "ensure the data described above was re-secured and not distributed." This phrasing is highly suggestive of a potential agreement between OnTrac and the attackers, which often involves a ransom payment. In the modern landscape of cybercrime, especially with ransomware and data extortion groups, it has become common for threat actors to not only encrypt a victim’s systems but also to exfiltrate sensitive data. They then use the threat of publicly leaking this stolen data as additional leverage to extort payment, a tactic known as "double extortion."

By stating that the data was "re-secured and not distributed," OnTrac implies that they have received assurances or taken actions to prevent the public release of the stolen information. This often comes at a significant financial cost, as companies weigh the reputational damage and potential legal liabilities of a data leak against the cost of a ransom. While paying a ransom can prevent immediate data leakage, it does not guarantee that the data will be permanently deleted by the attackers or that it won’t be sold privately on dark web forums. Furthermore, it can inadvertently incentivize future attacks, as it signals to cybercriminals that the organization is willing to pay. The global debate surrounding the ethics and effectiveness of paying ransoms continues, with law enforcement agencies often advising against it. At the time of writing, no specific ransomware or data extortion threat groups have publicly claimed responsibility for the attack on OnTrac, which could indicate ongoing negotiations or a successful, discreet resolution to prevent public disclosure by the attackers.

Mitigation Measures for Affected Customers

In response to the security incident and to help exposed customers mitigate potential risks, OnTrac is offering a complimentary 12-month subscription to a credit monitoring and identity protection service through CyberScout. This service is a common offering in the wake of data breaches, designed to alert individuals to suspicious activity related to their financial and personal identity. Customers typically have a 90-day enrollment deadline to activate this service, underscoring the urgency for vigilance.

Beyond the offered service, OnTrac, consistent with standard cybersecurity recommendations, has urged recipients of the breach notification letter to take proactive steps to protect themselves. These recommendations include:

Reviewing Credit Reports: Regularly obtaining and reviewing free credit reports from the three major credit bureaus (Equifax, Experian, and TransUnion) allows individuals to spot unauthorized accounts or suspicious inquiries.
Monitoring Account Statements: Carefully scrutinizing bank, credit card, and other financial account statements for any unusual or unrecognized transactions can help detect fraudulent activity early.
Placing a Fraud Alert: A fraud alert on a credit file signals to creditors that they should take extra steps to verify identity before extending new credit. This is generally free and lasts for one year, though it can be renewed.
Implementing a Credit Freeze: A credit freeze, also known as a security freeze, restricts access to a credit report, making it difficult for identity thieves to open new accounts in an individual’s name. This offers a higher level of protection than a fraud alert and can be lifted temporarily when applying for legitimate credit.

These measures are crucial because even if OnTrac’s actions have prevented public distribution of the data, the possibility of private sales or future misuse by the attackers cannot be entirely eliminated.

Broader Implications for the Logistics Sector and Cybersecurity

The OnTrac data breach serves as a stark reminder of the persistent and evolving threat landscape faced by the logistics and supply chain sector. These companies are prime targets due to the vast amounts of personal and proprietary data they manage, the interconnectedness of their operations, and their critical role in the global economy. A successful attack can disrupt operations, compromise sensitive information, and erode customer trust.

The incident highlights several critical areas for organizations:

Robust Network Security: Companies must continuously invest in and update their network security infrastructure, including firewalls, intrusion detection systems, and advanced endpoint protection. Regular vulnerability assessments and penetration testing are essential to identify and address weaknesses before attackers exploit them.
Data Minimization and Segmentation: Storing only necessary data and segmenting networks can limit the scope of a breach. If attackers gain access to one segment, it should not automatically grant them access to the entire corporate network.
Employee Training: Human error remains a leading cause of security incidents. Comprehensive and ongoing cybersecurity training for all employees, focusing on phishing awareness, strong password practices, and secure data handling, is paramount.
Incident Response Planning: A well-defined and regularly tested incident response plan is crucial for minimizing the damage from a breach. This includes clear roles and responsibilities, communication protocols, and forensic capabilities.
Third-Party Risk Management: Given OnTrac’s reliance on 7,000+ independent contractors, assessing and managing the cybersecurity risks associated with third-party vendors and partners is increasingly vital. A breach in a less secure partner’s system could potentially create an entry point into the primary company’s network.

Regulatory Landscape and Potential Consequences

Data breaches of this magnitude invariably attract regulatory scrutiny. Depending on the residency of the affected customers, OnTrac could face investigations under various data privacy regulations, including state-specific laws like the California Consumer Privacy Act (CCPA) or broader federal regulations. Non-compliance with breach notification requirements or inadequate security measures can lead to significant fines and penalties.

Beyond regulatory action, OnTrac may also face civil litigation from affected customers seeking damages for privacy violations and potential identity theft. Such lawsuits can be costly, both in terms of legal fees and potential settlements, and can further damage a company’s reputation. The long-term financial implications of a data breach extend beyond immediate incident response costs, encompassing legal fees, regulatory fines, public relations campaigns, and the cost of offering credit monitoring services.

Conclusion: An Ongoing Challenge

The OnTrac data breach serves as another reminder of the relentless challenges in cybersecurity. While OnTrac has taken immediate steps to address the incident, including engaging specialists and offering identity protection services, many questions remain unanswered. The full extent of compromised data, the exact number of affected customers, and whether a ransom was paid are crucial details that will shape the long-term impact on the company and its clientele. As investigations continue, this event will undoubtedly contribute to the ongoing conversation about corporate responsibility in safeguarding personal data and the critical need for proactive, robust cybersecurity defenses in an increasingly interconnected and threatened digital world.

July 24, 2026 0 comment