CANADIAN HACKER PLEADS GUILTY IN U.S. CLOUD STORAGE ACCOUNT BREACHES AFFECTING AT LEAST 165 ORGANIZATIONS

SEATTLE — Canadian national Connor Riley Moucka has pleaded guilty to federal charges connected to a sweeping campaign that used stolen credentials to access accounts belonging to customers of a U.S.-based software-as-a-service company, steal billions of sensitive records and extort organizations across the United States and abroad.

Moucka, 26, of Kitchener, Ontario, entered the guilty plea Wednesday in the Western District of Washington. He admitted to computer fraud, wire fraud, aggravated identity theft and a related conspiracy.

His sentencing is scheduled for October 27, 2026. Moucka faces a maximum combined penalty of up to 32 years in federal prison, although the sentence will be determined by the court after reviewing federal sentencing guidelines and other statutory factors.

The guilty plea moves Moucka’s case beyond the accusation stage. The conduct he admitted should not be described as alleged, although charges involving any remaining defendant must continue to be treated as allegations unless resolved through a guilty plea or conviction.

Between February and October 2024, Moucka and his co-conspirators used stolen login credentials to gain unauthorized access to cloud-hosted data belonging to customers of the U.S.-based software-as-a-service company. The campaign affected at least 165 organizations and exposed enormous collections of corporate and customer information.

Across the wider campaign, the stolen information included banking records, financial information, payroll records, Drug Enforcement Administration registration numbers, driver’s license numbers, passport numbers, Social Security numbers and other personally identifiable information.

These records carried value beyond the initial extortion demands. Identity information, government registration data and financial records can be packaged for sale, used to support fraud or combined with other stolen information to create more convincing criminal schemes.

Moucka and his co-conspirators threatened to publish stolen data unless the victim organizations paid ransoms. The group received more than $2.5 million through its extortion activity.

Court records also described a re-extortion attempt in which Moucka targeted a victim for a second payment. Prosecutors said he used stolen information belonging to a government officer and members of a former government officer’s immediate family as leverage during that effort.

Re-extortion extends the pressure beyond the original demand. Payment does not guarantee that stolen information was deleted, that additional copies do not exist or that the perpetrators will not return with another threat. The same data can remain useful to the criminals long after the first payment is made.

Moucka also advertised stolen information on cybercriminal forums, including BreachForums and XSS.is. He received at least $495,000 through the sale of data obtained during the campaign.

The combined extortion payments and data sales show that the stolen records were monetized through several channels. Victim organizations were pressured directly while portions of their information were also offered to other criminals through online marketplaces.

Court documents placed losses suffered by the victim companies at more than $9.5 million. That figure reflects the direct financial damage attributed to the breaches but does not fully describe the long-term burden placed upon affected organizations and customers.

Companies confronted incident-response costs, forensic reviews, legal expenses, notification obligations and the operational work required to determine what information had been removed. Customers faced uncertainty over whether their personal, financial or communications records would be sold, published or used in future fraud.

“Connor Moucka’s threats and re-extortion tactics were calculated and predatory, and his actions did real harm to his victims, be they companies targeted for theft and extortion or the millions of everyday people who are their customers,” said FBI Special Agent in Charge W. Mike Herrington.

Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division, First Assistant U.S. Attorney Charles Neil Floyd for the Western District of Washington, Assistant Director Brett Leatherman of the FBI’s Cyber Division and Special Agent in Charge W. Mike Herrington of the FBI Seattle Field Office announced the guilty plea.

Moucka was arrested in Canada in October 2024 and consented to surrender for extradition purposes in March 2025. He was transferred to the United States and made his initial appearance in the Western District of Washington on July 3, 2025.

He initially pleaded not guilty and remained in federal custody while the case proceeded. His new guilty plea eliminates the need for prosecutors to prove the admitted charges against him at trial.

John Erin Binns was charged as Moucka’s co-defendant in the federal case. Prosecutors accused Binns of participating in computer fraud, wire fraud, aggravated identity theft, extortion and related conspiracies.

Those charges remain allegations unless Binns enters a guilty plea or is convicted in court. He is not presently in United States custody, and Moucka’s guilty plea does not establish Binns’ guilt.

The FBI investigated the case. Trial Attorneys Louisa K. Becker and George S. Brown of the Justice Department’s Computer Crime and Intellectual Property Section and Assistant U.S. Attorney Sok Tea Jiang for the Western District of Washington prosecuted the case.

The Justice Department’s Office of International Affairs provided substantial assistance in obtaining Moucka’s arrest and July 2025 extradition from Canada. The Royal Canadian Mounted Police, Australian Federal Police, Spain’s Guardia Civil, Security Service of Ukraine and Turkish National Police also provided substantial assistance.

The campaign exposed the danger created when stolen credentials remain active for extended periods. A password obtained through earlier malware activity, credential theft or another compromised system can continue providing access until the affected organization identifies the exposure and invalidates it.

Valid credentials can also make malicious activity more difficult to distinguish from ordinary account use. The attacker may enter through the same authentication system used by authorized personnel, making strong multifactor authentication, credential rotation, access restrictions and behavioral monitoring critical to detecting unauthorized activity.

Cloud customers remain responsible for protecting the identities, accounts and credentials used to reach their environments. Organizations should enforce multifactor authentication, eliminate dormant accounts, rotate exposed credentials, restrict administrative access and review unusual login activity involving unfamiliar devices, locations or large data transfers.

Moucka’s guilty plea establishes his responsibility for a campaign that reached at least 165 organizations, generated millions of dollars through extortion and data sales, and exposed information belonging to at least 100 million people.

His scheduled October sentencing will determine the punishment imposed for conduct that turned stolen credentials into a pathway for mass data theft, repeated extortion and the criminal sale of sensitive information.

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---