DOJ confirms arrested US Army soldier is linked to AT&T and Verizon hacks

US prosecutors have formally linked the December arrest of a serving US Army soldier to the massive theft of US phone records from AT&T and Verizon last year.

U.S. Army communications specialist Cameron John Wagenius was arrested by authorities in Texas on Dec. 20 A brief two-page grand jury complaint Charge the US serviceman with two counts of illegally transferring confidential phone records. Wagenius was later extradited to Washington state.

In a new court filing Friday, U.S. prosecutors confirmed that the charges against Wagenius are related to earlier indictments of two alleged hackers, Connor Mouka and John Binns, who have been indicted by the U.S. government. Multiple intrusions at cloud computing company Snowflake which has seen widespread theft of data stored on its customer accounts. Snowflake customers whose data was stolen include AT&T, which had “almost all” customer call records removed from its Snowflake accounts by 2024, and Verizon, from which a significant cache of customer call logs was taken.

US Attorney Tessa Gorman Seattle told the court that, “both cases arise from the same computer intrusion and extortion and involve some of the same stolen victim information” and, as such, “these cases rely on overlapping evidentiary and legal processes and arguably present common questions of law and fact.”

It is the first public acknowledgment by prosecutors that Wagenius’ allegations are linked to last year’s breach of cloud computing company Snowflake. Security journalist Brian Krebs Report on the first link Between the Wagenius and Snowflake hacks in November, and Later the news broke Wagenius’s arrest

Snowflake’s account hacks became one of the most widespread cyberattacks of the past year, affecting AT&T, Lending Tree, Santander Bank, Ticket Masterand at least 160 other companies. Hackers stole vast banks of personally identifiable and sensitive corporate data that companies stored on Snowflake, in part Using passwords stolen from employee computers with malware. Most of the affected Snowflake customers were not using multi-factor protection, which Snowflake did not require of its customers at the time.

According to Krebs’ report, the following Mouka was earlier arrested by Canadian authoritiesWagenius claimed in a post on a well-known cybercrime forum to have access to the call logs of Vice President Kamala Harris and then-President-elect Donald Trump, and threatened to release all the stolen files unless Mauka was released.

Prosecutors allege the Snowflake hackers stole data including personal information, cell phone and IMEI numbers, dates of birth, postal and email addresses, passwords, Social Security numbers, government-issued identification numbers, as well as payment card and bank account numbers.

Wagenius was ordered detained on January 8 and is understood to be in custody in Washington state.