U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions

A U.S. Army soldier has been sentenced to 70 months in federal prison for hacking telecommunications firms and stealing call and text metadata from more than 100 million AT&T customers. Cameron John Wagenius, 22, also must pay $294,978 in restitution. The sentence followed his guilty plea to all counts in two federal indictments. Prosecutors described a case spanning mass data theft, extortion, and insider risk.

Wagenius was stationed at a U.S. Army base in South Korea when he adopted the alias “Kiberphant0m.” He and three alleged co-conspirators obtained data from companies that were major Snowflake customers. The accounts had exposed credentials and lacked mandatory multi-factor authentication, though Snowflake has since required MFA for every account. The records included phone numbers, timestamps, and call durations, but not message content.

In October 2024, Kiberphant0m claimed on cybercrime forums to have taken metadata from tens of millions of AT&T users and compromised more than a dozen telecom businesses. Verizon’s Push-to-Talk operation was reportedly among the targets. The group threatened to release stolen data unless victims paid ransoms. AT&T reportedly paid $370,000 in Bitcoin after the crew claimed responsibility.

The scheme grew more serious when Wagenius admitted to re-extorting victims and threatening to disclose national-security secrets. Following the arrest of Conor Riley Moucka, Kiberphant0m posted alleged AT&T logs involving then-President-elect Donald Trump and then-Vice President Kamala Harris. He also posted purported NSA schematics. Prosecutors treated the threats as leverage and as a warning that commercial intrusions could intersect with political or military intelligence.

Federal prosecutors said Kenneth Schuchman, 28, assisted with extortion. He previously pleaded guilty to operating the Satori botnet, a network of compromised IoT devices used for denial-of-service attacks. Moucka, also known as “Judische,” was arrested in 2024 and pleaded guilty, while John Erin Binns remains wanted over a 2021 T-Mobile breach affecting at least 76 million people. Their cases show how the group connected experienced offenders across borders.

Paul Russell, a resident agent in charge at the Defense Criminal Investigative Service, said the case quickly mobilized several agencies. DCIS worked with the FBI, Army Criminal Investigative Division, and Secret Service after learning that an active-duty soldier with secret clearance was building hacking tools and trafficking data. Russell called it an unusual insider threat that left partners unsure what they were facing. The conviction carries consequences beyond ordinary cybercrime enforcement.

For AT&T and Verizon, the case shows why metadata remains valuable even when message content is absent. Phone numbers, timing, and duration can reveal personal relationships, routines, and locations. Such exposure can fuel fraud, targeted phishing, operational disruption, and reputational damage long after a breach. Mandatory MFA and rigorous credential controls at cloud customers are therefore central defenses.

Despite Wagenius’s early guilty plea and cooperation, prosecutors said he recently searched for vulnerabilities in the Bureau of Prisons network. That conduct may complicate his custody and suggests his technical interests continued after the investigation. Future proceedings still must address Binns and determine whether the claimed national-security files were authentic or shared. More broadly, the case is likely to accelerate stricter cloud-security rules, stronger telecom incident response, and closer screening for insider cyber risks.

Turn any website into clean JSON.

Ready-made scrapers & AI agents

Try Apify