U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions – Krebs on Security

A 22-year-old active-duty U.S. Army soldier, Cameron John Wagenius, has been sentenced to 70 months in federal prison and ordered to pay nearly $300,000 in restitution after admitting he hacked multiple telecom firms and stole call and text metadata belonging to over 100 million AT&T customers. Operating under the alias Kiberphant0m, Wagenius exploited Snowflake cloud accounts belonging to large corporate customers that had exposed credentials and lacked multi-factor authentication, also targeting Verizon's Push-to-Talk division and extorting victims by threatening to leak the stolen records. Prosecutors noted that while jailed awaiting sentencing, he tried using other inmates' email access to get AI tools to generate exploit code for Windows 10 privilege-escalation flaws and a D-Link vulnerability tracked as CVE-2023-45208, disguising the requests as research for a book. Despite the massive scale of the breach, the government says his criminal earnings totaled only about $1,500, while two alleged accomplices, Conor Riley Moucka and John Erin Binns, still face related charges.