(Photo by Joan Cros/NurPhoto via Getty Images)
Investigators in Canada have arrested a hacker who allegedly breached over 100 companies by targeting cloud storage provider Snowflake.
Alexander “Connor” Moucka was arrested last week on a request from the US, Canada's Justice Department says. Although the charges haven’t been released, sources tell Bloomberg that Moucka is behind a series of hacks that ensnared Snowflake earlier this year.
"As extradition requests are considered confidential state-to-state communications, we cannot comment further on this case," the agency said in a statement sent to PCMag.
US-based Snowflake helps hundreds of major companies analyze and store their internal data. However, earlier this year, a hacker accessed numerous Snowflake accounts that were only secured with a password rather than multi-factor authentication.
As a result, as many as 165 organizations—including AT&T, Neiman Marcus, and possibly Ticketmaster—were breached, enabling the hacker to steal sensitive data on consumers. To uncover the passwords, the attacker sourced the login credentials from various strains of “infostealing” malware used as far back as 2020 on victim computers.
The hacker, who used the name “Judische,” would then threaten to sell the stolen information to other hackers unless victim companies paid a ransom. In September, Judische boasted about raking in $2 million from the sales. However, according to 404 Media, he also made some crucial mistakes that may have helped investigators track him down, like accidentally posting his computer’s system information in a ransom video he created to pressure a victim to pay.
Google’s Mandiant cybersecurity division was tracking the hacker closely, and amassed about 300 indicators related to Judische and his activities. It also worked with US and international law enforcement to catch the suspect.