Canadian authorities arrested Alexander “Connor” Moucka on October 30, 2024, after a U.S. request for a provisional arrest warrant. Investigators linked him to a campaign that used stolen credentials to access Snowflake customer environments, including AT&T’s. Moucka consented to extradition in March 2025, was extradited to the United States in July 2025, and pleaded guilty to four counts on August 5, 2026.
Who was arrested in Canada?
The suspect was Alexander Moucka, also known as Connor Moucka. Canada’s Department of Justice said he was arrested at the request of the United States on October 30, 2024. At the time, the alleged conduct had not been resolved in court; Moucka later pleaded guilty in the U.S. case.
How was AT&T connected to the Snowflake campaign?
Stolen credentials were used to access customer accounts
U.S. prosecutors said Moucka and co-conspirator John Binns used stolen credentials to compromise cloud data belonging to at least 165 customers between February and October 2024. The targets included organizations using Snowflake, a cloud data platform. The allegations concerned access to customer environments, not a claim that Snowflake’s own platform was itself breached.
AT&T call and text records were among the data
AT&T’s Snowflake account was used to exfiltrate call and text records. In 2025 reporting on a DOJ court filing, TechCrunch said nearly all AT&T customer call records through 2024 had been taken from the account. That description concerns call records, not the number of individual database rows or a count of people.
#1 Best Overall
How many AT&T customers were affected?
TechCrunch reported that about 110 million AT&T customers were subject to notification, summarizing reporting from the indictment period. That customer estimate and the description of “nearly all” call records measure different things; they should not be treated as interchangeable counts. The available figures do not establish one consistent exact total for records exfiltrated.
How large was the alleged campaign?
The Justice Department’s August 5, 2026 account gives the following scale figures. They describe the broader campaign and financial impact, not AT&T alone.
| Measure | Reported figure | What it refers to |
|---|---|---|
| Organizations compromised | At least 165 | Cloud data belonging to customers whose credentials were used between February and October 2024, according to the DOJ. |
| Data taken | Terabytes and billions of sensitive records | The DOJ’s description of the broader campaign; it does not provide a single exact AT&T record count. |
| Ransom payments received | More than $2.5 million | Payments the DOJ said the conspirators received from victims. |
| Documented victim-company losses | More than $9.5 million | Company losses cited by the DOJ, excluding customer losses. |
Companies named among the campaign’s victims included Ticketmaster, Advance Auto Parts, Santander, Neiman Marcus and LendingTree, as well as AT&T.
What happened to Moucka after his arrest?
Extradition
Moucka consented to extradition in March 2025 and was transferred from Canada to the United States in July 2025 to face the U.S. case.
Rank #3
Guilty plea and sentencing
On August 5, 2026, Moucka pleaded guilty to four counts. The DOJ said aggravated identity theft carries a mandatory minimum sentence of two years and the remaining counts carry a maximum of 30 years. His sentencing was scheduled for October 27, 2026; that date was still in the future as of October 3, 2026.
The DOJ quoted Assistant Attorney General A. Tysen Duva as saying Moucka “hacked over 150 companies and organizations, obtained extremely sensitive information, and extorted the victims for millions of dollars.” FBI Cyber Division Assistant Director Brett Leatherman said, “Hiding behind a screen is no shield from justice.” These are statements from the DOJ’s August 5, 2026 announcement.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the case establishes—and what it does not
Moucka’s guilty plea marks a change from the allegations reported at the time of his arrest. It does not make every public estimate of AT&T records or affected customers an exact count, nor does it resolve separate allegations against Binns. The case is about credential-based access to cloud customer data, the resulting theft and extortion, and Moucka’s U.S. prosecution.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
