US Army soldier pleads guilty to hacking telcos and extortion

Former U.S. Army soldier Cameron John Wagenius pleaded guilty to hacking telecommunication companies and attempting extortion, the Department of Justice announced. Wagenius, operating as 'kiberphant0m,' stole login credentials, including from AT&T and Verizon, engaged in data sales, and committed SIM swapping, with his activities also linked to breaches originating from cloud computing service Snowflake. His sentencing is scheduled for October 6, where he faces up to 20 years, underscoring persistent cybersecurity threats and supply chain vulnerabilities for telecom and cloud-dependent enterprises.

Analysis

The guilty plea of former U.S. Army soldier Cameron John Wagenius brings a legal conclusion to a series of cyberattacks against at least ten telecommunication companies, including specific mentions of AT&T (T) and Verizon (VZ). The criminal activity was multifaceted, involving the theft of login credentials and call records, extortion attempts, and secondary fraud such as SIM swapping. Critically, the Department of Justice release links these hacks to a breach originating from cloud computing provider Snowflake (SNOW), highlighting a significant supply-chain vulnerability. While the sentencing of an individual hacker provides some closure, the event serves as a stark reminder of the persistent and sophisticated cybersecurity threats facing the telecom sector. The negative per-ticker sentiment scores for T (-0.6), VZ (-0.6), and particularly SNOW (-0.7) reflect investor concern over these operational security lapses, with Snowflake's higher negative score indicating perceived risk at the infrastructure level.

Key Decisions for Investors

• For investors in AT&T and Verizon, this news largely represents the legal resolution of a past breach, but it reinforces the necessity of scrutinizing the companies' ongoing capital expenditures on cybersecurity and incident response capabilities.
• The primary concern stems from the implication of Snowflake, whose investors should closely monitor for any disclosures regarding the scope of the platform breach, potential customer attrition, and any financial or reputational fallout.
• This incident highlights systemic third-party vendor risk; therefore, due diligence on companies heavily reliant on cloud infrastructure should now include a deeper assessment of their cloud providers' security posture and indemnification policies.