A U.S. Army soldier who pleaded guilty to hacking into multiple telecommunications companies and stealing mobile call and text metadata belonging to more than 100 million AT&T customers was sentenced to 70 months in federal prison. In addition to the nearly six-year prison term handed down in a Seattle federal courtroom, the defendant was ordered to pay approximately $294,978 in restitution to his victims.
Cameron John Wagenius, a 22-year-old service member, was stationed at a U.S. Army base in South Korea when he orchestrated his illicit digital operations under the cybercriminal moniker “Kiberphant0m.” Operating alongside three alleged co-conspirators, Wagenius exploited compromised enterprise cloud storage accounts. Specifically, the group targeted large customers of the cloud data storage service Snowflake by leveraging exposed credentials and taking advantage of environments that failed to enforce multi-factor authentication, a security loophole that has since prompted Snowflake to mandate multi-factor authentication across all accounts.
By October 2024, Wagenius began openly boasting on cybercrime forums about his acquisition of call and text metadata—including source and destination numbers, timestamps, and call durations—for tens of millions of AT&T customers. During this period, Kiberphant0m claimed responsibility for breaching more than a dozen telecommunications companies worldwide, including Verizon’s Push-to-Talk business, subsequently attempting to publicly extort these corporate entities under the threat of publishing the sensitive data online.
The digital trail eventually intersected with investigative journalism when KrebsOnSecurity published a warning in late November 2024 indicating that Kiberphant0m was likely an active-duty U.S. soldier stationed in South Korea. Less than a month after that reporting, Wagenius was arrested and subsequently faced two separate federal indictments, prompting him to plead guilty to all counts across both legal cases.
Federal prosecutors pointed to a web of collaboration, stating that Wagenius was assisted in his extortion plots by Kenneth Schuchman, a 28-year-old resident of Vancouver, Washington, with a substantial history of cybercriminal activity. Schuchman previously pleaded guilty in 2019 to operating the Satori botnet, a vast infrastructure of compromised Internet-of-Things devices utilized to launch large-scale distributed denial-of-service attacks.
Meanwhile, two other alleged co-conspirators linked to the Snowflake data thefts continue to navigate their respective legal proceedings. Conor Riley Moucka, also known as “Judische,” from Kitchener, Ontario, was arrested in 2024 and entered a guilty plea in August 2026. Another co-conspirator, John Erin Binns, an American citizen currently residing in Turkey, remains wanted by authorities in connection with a major 2021 data breach at T-Mobile that exposed the personal information of at least 76 million customers.
The gravity of Wagenius’s actions escalated when he engaged in secondary extortion tactics, threatening to leak sensitive national security secrets. Immediately following Moucka’s arrest—and after AT&T had already paid the extortion syndicate a Bitcoin ransom equivalent to $370,000—Kiberphant0m published information on hacker forums purporting to show call logs belonging to then-President-elect Donald Trump and then-Vice President Kamala Harris. The posts also included architectural schematics allegedly stolen from the U.S. National Security Agency.
Paul Russell, a resident agent in charge at the Defense Criminal Investigative Service, the criminal investigative arm of the U.S. Department of Defense Office of Inspector General, noted the unprecedented nature of the case. When DCIS received intelligence suggesting an active-duty soldier holding a secret security clearance was actively engaged in cybercrime and extortion, the agency launched a joint task force alongside the FBI, the Army Criminal Investigative Division, and the U.S. Secret Service.
According to Russell, discovering an insider threat of this magnitude involving an active-duty service member creating hacking tools and trafficking stolen data immediately mobilized federal partner agencies. Because the situation was unique, involved an insider threat with a high-level security clearance, and presented immediate unknowns, law enforcement treated the investigation with the highest degree of urgency from the very beginning.
Court documents unsealed ahead of the sentencing shed light on Wagenius’s behavior while incarcerated and awaiting legal resolution. A sentencing memo filed by federal prosecutors in Seattle noted that while Wagenius cooperated rapidly after his guilty plea, he was caught attempting to probe the computer network of the Bureau of Prisons for security vulnerabilities.
According to institutional records cited by the government, Wagenius used another inmate’s email system in September 2025 to instruct an external recipient to query a commercial artificial intelligence tool. The queries specifically asked for Common Vulnerabilities and Exposures related to Windows 10 Enterprise privilege escalation and bypasses, as well as real-world working scripts for those vulnerabilities. Less than a week later, using a different inmate’s account, Wagenius directed an AI tool to generate step-by-step instructions and code for a known command injection vulnerability affecting D-Link networking devices.
Prosecutors also alleged that Wagenius solicited instructions on how to construct a prison-grade antenna using commissary items to extend radio reception and researched methods for escaping a correctional facility. The sentencing memo detailed that Wagenius frequently framed these inquiries as research for a book he was writing, a technique characteristic of prompt injection, where attackers attempt to bypass safety guardrails built into commercial AI models to extract malicious code or exploitation instructions.
While the government acknowledged finding no evidence that Wagenius successfully deployed any vulnerabilities within Bureau of Prisons systems—and noted his claims that he was merely researching flaws to report them—the incident underscored his ongoing preoccupation with technical exploitation.
Despite the massive scale of the data he compromised and the high-profile nature of his targets, federal prosecutors revealed that Wagenius’s extortion enterprise was remarkably unprofitable. According to the government’s sentencing memo, Wagenius accumulated a total of only about $1,500 from selling stolen data.
In their closing remarks to the court, prosecutors summarized the duality of his criminal career, noting that while Wagenius achieved little financial success as a cybercriminal, his actions intentionally caused profound harm to individual victims, major U.S. corporations, and the federal government.
