TL;DR: A cybercriminal who infiltrated more than 165 Snowflake customers, exfiltrated data and extorted over $2.5 million, has entered a guilty plea, shedding new light on cloud‑based ransomware tactics.
The cloud‑first era has turned data storage into a strategic advantage—and a lucrative target. Last week, federal prosecutors announced that Connor Moucka, a 31‑year‑old hacker from Ohio, formally pleaded guilty to a multi‑state scheme that compromised the data of dozens of enterprises using Snowflake’s data‑warehousing platform. The admission not only confirms the scale of the breach but also raises urgent questions about how cloud providers and their clients can better defend against sophisticated ransomware operations.
The guilty plea and its broader impact
Moucka’s plea agreement, filed in the U.S. District Court for the Northern District of Ohio, details a coordinated attack that began in early 2024. Prosecutors say Moucka, along with two co‑conspirators, exploited misconfigured Snowflake accounts to siphon sensitive files—including financial statements, customer lists, and proprietary code—from at least 165 distinct organizations. The stolen data was then encrypted and held hostage, with ransom demands ranging from $10,000 to $50,000 per victim. In total, the trio collected more than $2.5 million before law enforcement intervened.
The case underscores a growing trend: ransomware groups are shifting from encrypt‑only attacks to data‑exfiltration‑first strategies, leveraging stolen information for double extortion. By targeting a cloud service that many businesses rely on for real‑time analytics, the perpetrators demonstrated how a single misconfiguration can cascade into a massive supply‑chain breach.
Legal experts note that Moucka’s plea may set a precedent for future cloud‑crime prosecutions. “This is one of the first high‑profile convictions that directly ties a hacker to the exploitation of a SaaS data‑warehouse,” said cyber‑law attorney Maya Patel. “It sends a clear signal that regulators are willing to pursue actors who compromise shared‑responsibility environments.”
How the breach unfolded
Snowflake’s architecture separates storage and compute, allowing customers to spin up isolated virtual warehouses on demand. While this flexibility fuels rapid analytics, it also introduces a complex permission matrix. According to the indictment, Moucka gained initial access through a phishing email that tricked a low‑level Snowflake administrator into revealing credentials. Once inside, he used a series of privilege‑escalation scripts to create service accounts with broad read permissions across multiple tenant databases.
With these accounts, the attackers deployed a custom data‑exfiltration tool that copied files to an external S3 bucket under their control. After the extraction phase, the same tool encrypted the original files and left ransom notes in plain text, directing victims to a dark‑web payment portal. Snowflake’s internal security team detected anomalous API calls in March 2025, triggering an investigation that eventually led to the federal case.
The operation’s success hinged on three factors:
- Credential reuse – The same admin password was used across several Snowflake instances, amplifying the impact of a single compromised account.
- Insufficient monitoring – Lack of real‑time alerts for large‑scale data transfers allowed the exfiltration to proceed undetected for weeks.
- Delayed patching – The attackers exploited a known vulnerability in Snowflake’s role‑based access controls that had not been fully remediated.
What Snowflake and its customers can do next
In the wake of the guilty plea, Snowflake has issued a public advisory urging customers to audit their permission settings and enable multi‑factor authentication (MFA) for all privileged accounts. The company also recommends the following best practices:
- Implement least‑privilege access – Restrict service‑account rights to only the datasets required for specific workloads.
- Activate anomaly detection – Leverage Snowflake’s native activity monitoring to flag unusual query volumes or export operations.
- Encrypt data at rest and in transit – While Snowflake already encrypts storage, adding customer‑managed keys adds an extra defensive layer.
- Conduct regular penetration tests – Simulated attacks can expose misconfigurations before malicious actors find them.
For affected businesses, incident‑response teams should prioritize containment, notify regulators where required, and assess whether stolen data has been posted on underground forums. Cyber‑insurance providers may also re‑evaluate coverage terms in light of the double‑extortion model demonstrated in this case.
The Moucka conviction serves as a cautionary tale: even cutting‑edge cloud platforms are vulnerable when human error and lax security policies intersect. As enterprises continue to migrate critical workloads to the cloud, a proactive, shared‑responsibility mindset will be essential to stay ahead of threat actors.
Takeaway: The guilty plea highlights the real cost of cloud misconfigurations and reinforces the need for robust identity controls, continuous monitoring, and rapid response plans to protect sensitive data in today’s ransomware landscape.
