Canadian authorities arrest suspect linked to Snowflake data breach and cybercrime ring

Canadian law enforcement arrested Alexander “Connor” Moucka, also known by online aliases “Judische” and “Waifu,” on October 30, 2024, in connection with a series of hacking incidents tied to a breach of Snowflake’s cloud data warehouse platform. Moucka was apprehended under a provisional arrest warrant issued at the request of the U.S., though details of the charges remain undisclosed.

This arrest follows a major data breach incident reported by Snowflake in June 2024. Snowflake disclosed that a targeted campaign compromised a limited number of its clients. Google-owned cybersecurity firm Mandiant attributed the attack to a financially motivated cybercrime group identified as UNC5537, whose members are believed to operate primarily in North America, with connections in Turkey. Approximately 165 organizations were reportedly affected by the campaign, including high-profile companies like Advance Auto Parts, AT&T, LendingTree, Neiman Marcus, Santander, and Ticketmaster (Live Nation).

In some instances, the hackers demanded payment from targeted organizations, threatening to sell stolen data on criminal forums if their demands were unmet. AT&T allegedly paid the group $370,000 to secure the deletion of compromised data, according to a report from WIRED. The intrusions typically exploited stolen customer credentials obtained through prior stealer malware infections. Investigations revealed that initial malware infections occurred on contractor systems for downloading games and pirated content, providing attackers access.

The arrest of Moucka sheds light on the extent of his involvement in a broader criminal network known as “The Com,” which is notorious for both digital and physical attacks to gain access to accounts and illicit funds. Previous investigations by Krebs on Security and 404 Media connected Moucka, or Judische, to the Canadian cybercrime community, with links to the international cybercrime ecosystem. Additionally, Moucka is believed to have worked alongside John Binns, a hacker apprehended in Turkey earlier this May.