A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata belonging to more than 100 million AT&T customers was sentenced in a Seattle federal court to 70 months in federal prison. In addition to the prison term, the former soldier was ordered to pay nearly $300,000 in restitution to his victims, concluding a high-profile case that exposed severe vulnerabilities in cloud data storage and ignited a multi-agency federal investigation into a sophisticated insider threat.
Cameron John Wagenius, a 22-year-old active-duty soldier who was stationed at a U.S. Army base in South Korea at the time of the offenses, operated under the online cybercriminal moniker “Kiberphant0m.” Working alongside a network of alleged co-conspirators, Wagenius exploited exposed credentials and accounts that failed to enforce multi-factor authentication (MFA) within cloud data storage service Snowflake. These security lapses allowed the group to download vast amounts of sensitive data belonging to several large corporate customers. Although Snowflake has since mandated multi-factor authentication across all accounts, the initial breaches had already given the threat actors unprecedented access to corporate environments.
By October 2024, operating as Kiberphant0m, Wagenius began bragging on dark web cybercrime forums about his exploits. He claimed to have successfully stolen the call and text metadata—including source and destination phone numbers, timestamps, and call durations—for tens of millions of AT&T customers. Furthermore, Wagenius boasted that he had hacked into more than a dozen telecommunications companies worldwide, including Verizon’s Push-to-Talk enterprise business. True to his extortionist persona, he publicly threatened these corporations, demanding payoffs in exchange for promises not to publish the proprietary and sensitive data caches.
The trail leading to Wagenius began to unravel in late November 2024, when cybersecurity journalist Brian Krebs published reporting warning that the elusive hacker known as Kiberphant0m was likely a U.S. soldier stationed in South Korea. Less than a month after those investigative reports surfaced, Wagenius was arrested. He was subsequently charged in two separate federal indictments and quickly chose to plead guilty to all counts across both cases, accepting responsibility for his role in the international conspiracy.
At his sentencing hearing, federal prosecutors detailed the vast scope of the conspiracy, emphasizing that Wagenius did not act alone. According to court filings, Wagenius was assisted in his extortion efforts by Kenneth Schuchman, a 28-year-old resident of Vancouver, Washington, who possessed a lengthy and notorious history in the cybercrime underworld. Schuchman previously pleaded guilty in 2019 to operating the Satori botnet, a massive collection of compromised Internet-of-Things devices that had been weaponized to launch devastating, large-scale distributed denial-of-service attacks against critical infrastructure and online services.
Other alleged co-conspirators connected to the Snowflake data theft ring also faced aggressive legal action. Conor Riley Moucka, operating under the alias “Judische” in Kitchener, Ontario, was arrested in 2024 and subsequently pleaded guilty in August 2026. Another prominent figure named in connection with the broader network is John Erin Binns, an American citizen currently residing in Turkey, who has also been wanted by authorities for his alleged involvement in a massive 2021 data breach at T-Mobile that exposed the personal identifying information of at least 76 million customers.
As the investigation deepened, federal law enforcement uncovered increasingly alarming behavior from Wagenius, including attempts to re-extort victim companies and dangerous threats to disclose classified national security secrets. Immediately following the arrest of co-conspirator Moucka—and even after AT&T had already paid the extortion group a $370,000 Bitcoin ransom—Kiberphant0m retaliated on hacker forums. He published what he asserted were the AT&T call logs belonging to then President-elect Donald Trump and then Vice President Kamala Harris, alongside documents and schematics allegedly stolen from the U.S. National Security Agency.
The involvement of an active-duty soldier with a secret security clearance triggered an immediate and intense response from national defense and law enforcement agencies. Paul Russell, a resident agent in charge at the Defense Criminal Investigative Service (DCIS)—the criminal investigative arm of the U.S. Department of Defense Office of Inspector General—explained the gravity of the situation when the initial intelligence arrived.
“We don’t often get leads where there’s an active-duty soldier with a secret clearance who’s creating hacking tools and trafficking in data,” Russell said. “That doesn’t happen every day, and so when that hits it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren’t sure what we were dealing with.”
This realization led to a collaborative, multi-agency task force that brought together the DCIS, the Federal Bureau of Investigation, the Army Criminal Investigative Division, and the U.S. Secret Service to dismantle the threat.
Even while incarcerated and awaiting sentencing, Wagenius continued to test the limits of security controls. A sentencing memo filed by federal prosecutors in Seattle revealed that Wagenius was caught attempting to probe the computer network of the Bureau of Prisons (BOP) to identify potential security vulnerabilities. According to BOP records from September 2025, Wagenius used another inmate’s email system to instruct an external recipient to query a commercial artificial intelligence tool. He asked the AI to provide specific Common Vulnerabilities and Exposures identifiers related to Windows 10 Enterprise privilege escalation, alongside real-world working scripts with un-omitted code.
Less than a week later, Wagenius reportedly utilized a different inmate’s email account to prompt an AI tool for step-by-step instructions and potential code regarding CVE-2023-45208, a command injection vulnerability affecting D-Link networking devices. During the same month, he also sought instructions on how to construct a makeshift antenna using prison commissary items to extend radio reception, as well as information regarding prison escape methods.
Prosecutors noted that Wagenius frequently framed his malicious queries by pretending they were research for a book he was writing—a classic technique known as "prompt injection," designed to bypass the safety guardrails built into commercial AI models to prevent the generation of actionable exploit code. While federal prosecutors stated they found no evidence that Wagenius successfully deployed or utilized these vulnerabilities within the prison’s systems, his ongoing probing demonstrated an unyielding impulse for exploitation. When confronted by investigators, Wagenius claimed he was merely researching vulnerabilities to report them to the Bureau of Prisons.
Despite the monumental scale of data theft involving major telecommunications providers like AT&T and Verizon, the government’s sentencing memo highlighted a surprising reality: Wagenius’s high-stakes cybercriminal enterprise was remarkably unsuccessful from a financial standpoint. Investigators estimated that across all of his extensive extortion and data-peddling efforts, Wagenius netted a total of only about $1,500.
“While Wagenius was not particularly financially successful as a cybercriminal, he both intended to and caused significant harm to numerous individual victims, U.S. companies, and the U.S. government,” prosecutors stated in the court filing.
With his sentencing now finalized at nearly six years behind bars and substantial financial restitution mandated, the case serves as a striking reminder of the intersection between insider threats, corporate cloud security failures, and the relentless reach of federal cybercrime investigators.
