A Seattle federal court sentenced Cameron John Wagenius, a 22-year-old U.S. Army soldier, to 70 months in prison for hacking telecom companies and stealing mobile call and text metadata, according to KrebsOnSecurity. The court held the hearing Sept. 25, 2026, per the case record cited in the fact sheet.
The court also ordered $294,978 in restitution to victims. Seventy months is just under six years. SecurityWeek reports Wagenius pleaded guilty in July 2025 to wire fraud conspiracy and extortion charges.
How the scheme worked
KrebsOnSecurity reports Wagenius, stationed at a U.S. Army base in South Korea, took the online persona Kiberphant0m. It says he and three alleged co-conspirators took data from Snowflake customers whose credentials were exposed and who did not enforce multifactor authentication, a second login step. Snowflake has since mandated it on all accounts, the report says.
SecurityWeek, citing court documents, puts the hacking between April 2023 and December 2024, while Wagenius was on active duty. The documents say the group targeted at least 10 organizations and sought at least $1 million in extortion. SecurityWeek says attackers obtained credentials with a utility called SSH Brute and other tools.
The two accounts describe access differently. KrebsOnSecurity points to exposed Snowflake credentials, while SecurityWeek points to SSH Brute and other tools, and neither outlet presents the other’s description.
Kiberphant0m claimed to have breached more than a dozen telecom companies worldwide, including Verizon’s Push-to-Talk business, according to KrebsOnSecurity. The report says he publicly extorted them by promising not to publish the stolen data.
The AT&T claims
KrebsOnSecurity relays Wagenius’s own claim that the stolen metadata covered more than 100 million AT&T customers in 2024. The fields he cited include source and destination numbers, timestamps and call duration. SecurityWeek’s account does not state that figure.
KrebsOnSecurity reports AT&T had already paid an extortion group a $370,000 Bitcoin ransom when Kiberphant0m, after Conor Moucka’s arrest, posted what he claimed were AT&T call logs for then President-elect Donald Trump and then Vice President Kamala Harris, plus alleged NSA schematics. Those are Wagenius’s unverified claims.
SecurityWeek, citing court documents, says that in November 2024 Wagenius posted phone records tied to a government official and warned more would follow.
Differing arrest accounts
The outlets give conflicting timelines. SecurityWeek says authorities arrested Wagenius in December 2024. KrebsOnSecurity says authorities arrested him less than a month after its late-November 2025 warning that Kiberphant0m was likely a soldier in South Korea.
An insider with outside ties
KrebsOnSecurity reports the FBI, Army CID and the Secret Service joined the case because the suspect was an active-duty soldier with a secret clearance. Paul Russell of the Defense Criminal Investigative Service called that rare. Reports differ on Russell’s title: one says resident agent in charge, another supervisory special agent.
We don't often get leads where there's an active duty soldier with a secret clearance who's creating hacking tools and trafficking in data
Paul Russell, Defense Criminal Investigative Service, U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions
Prosecutors’ sentencing memo, as relayed by KrebsOnSecurity, says Wagenius made only about $1,500 from selling stolen data. The memo also says he intended and caused significant harm to individuals, U.S. companies and the U.S. government.
Jail-time AI queries
KrebsOnSecurity reports that while jailed before sentencing, Wagenius used other inmates’ email accounts to have outsiders put questions to commercial AI tools about Windows 10 and CVE-2023-45208, a D-Link command injection flaw. Prosecutors say he framed some queries as being for a book, which they call prompt injection. He also asked about prison antennas and escape.
The government has no evidence he used any exploit against Bureau of Prisons systems, the report says. Wagenius said he was researching vulnerabilities to inform the bureau.
What the case shows
KrebsOnSecurity describes the Snowflake thefts as resting on exposed credentials and accounts without multifactor authentication, the gap Snowflake has since closed by requiring it. Extortion messages that cite call records or threaten to leak data are the tactic the report describes Kiberphant0m using publicly against telecom companies.
Join the discussion