The US Department of Justice has filed charges against Connor Moucka and John Binns, alleging that they orchestrated a cyberattack that breached AT&T’s systems, compromising approximately 50 billion call and text records of its customers. The indictment, filed on Sunday, accuses Moucka and Binns of infiltrating AT&T’s data analytics cloud services used by AT&T, specifically its instances on Snowflake, around mid-April. AT&T reported the breach publicly in July and stated it affected almost all of its US-based cellular and landline customers. The stolen data includes metadata, such as who contacted whom, without the content of the messages.
The DOJ’s documentation refers only to “Victim-2,” describing it as a “major telecommunications company” breached on April 14—details that align with AT&T’s prior statements, making it nearly certain that Victim-2 is AT&T. The DOJ has not officially confirmed the identity of Victim-2, and AT&T has refrained from commenting on the matter. DOJ spokesperson Emily Langlie also declined to comment.
According to the indictment, Moucka and Binns allegedly exploited Snowflake’s cloud environment to siphon off sensitive data, not just from AT&T but also from other companies, including Santander Bank and Ticketmaster, and up to 165 additional corporate clients. This data trove includes personal and corporate information like social security numbers, passport and driver’s license data, and financial details, amplifying the breach’s severity.
The hackers allegedly demanded ransom payments, threatening to release stolen data if companies refused. AT&T reportedly paid US$370,000 in an attempt to secure the deletion of the compromised data. Prosecutors note that at least three companies succumbed to similar extortion demands, paying 36 bitcoins (around US$2.5 million) between November 2023 and October 2024.
Moucka, identified online by various aliases such as “judische” and “catist,” was apprehended in Canada last week, while Binns, known as “irdev” and “j_irdev1337,” had already been detained in Turkey. Binns claimed responsibility for the breach in August through The Wall Street Journal, while Moucka predicted his arrest in a statement to 404 Media.
