DOJ Charges 2 Men in Massive AT&T Data Breach

The Justice Department has charged two men with hacking a third-party cloud data storage that led to the massive data breach of AT&T, Ticketmaster, and more than 150 other corporations.

Connor Moucka and John Binns were indicted for hacking at least 10 computer networks, according to a court filing in U.S. District Court for the Western District of Washington at Seattle.

Cloud data storage and analytics company Snowflake was among the victims, according to multiple reports.

According to the indictment, Moucka and Binns extracted around 50 billion phone call and text message records.

Although the content of those calls and texts weren't stolen, the records were enough to extort affected customers.

"Through this scheme, the co-conspirators gained unlawful access to billions of sensitive customer records, including individuals' non-content call and text history records, banking and other financial information, payroll records, Drug Enforcement Agency (DEA) registration numbers, driver's license numbers, passport numbers, Social Security Numbers, and other personally identifiable information," the indictment said.

The indictment noted that Moucka and Binns were successful in extorting at least three victims of at least 36 bitcoin — roughly $2.5 million when the victims paid — over a span of almost a year.

In July, AT&T said the company suffered a massive hacking incident as data from about 109 million customer accounts containing records of calls and texts from 2022 was illegally downloaded in April.

The hackers stole the phone records of "nearly all" of its customers, a company spokesperson told TechCrunch.

The indictment did not mention AT&T but said "Victim-2" was "a major telecommunications company located in the United States," which was breached around April 14.

Moucka, who was arrested in Canada last week, is also known online as "judische," "catist," "waif," and "cllyels."

Binns, whom 404 Media said was previously arrested in Turkey, was known as "irdev" and "j_irdev1337."

Reuters contributed to this report.