US soldier AT&T Verizon extortions draw 70 months

US soldier AT&T Verizon extortions landed Cameron John Wagenius a 70-month federal prison sentence today, closing a case that began with stolen call logs and ended with a soldier in South Korea trying to hack his way out of a Bureau of Prisons cell.

Wagenius is 22. He stood in a Seattle courtroom. A judge ordered him to pay $294,978 in restitution to victims. And that's the number they're stuck with. But here's what makes it worse: the Army soldier had been stationed at a base in South Korea when he adopted the handle "Kiberphant0m" and set about stealing data from some of the largest telecommunications companies in the world, a quiet scheme that stretched across borders before it ever reached a judge.

How Kiberphant0m Pulled Data From Snowflake Customers

Working alongside three alleged co-conspirators, Kiberphant0m pulled data from several large customers of the cloud storage service Snowflake. Those accounts had exposed credentials and did not enforce multi-factor authentication at the time. Snowflake has since mandated MFA across all accounts.

In October 2024, Kiberphant0m boasted on cybercrime forums that he had taken call and text metadata for tens of millions of AT&T customers. That metadata included source and destination numbers, timestamps, and call durations. He claimed to have breached more than a dozen telecommunications companies worldwide, Verizon's Push-to-Talk business among them, then publicly extorted those companies with a simple promise: pay up, or the data goes public.

The Soldier Behind the Screen

The persona did not stay anonymous forever. In late November 2025, reporting warned that Kiberphant0m was likely a US soldier stationed in South Korea. Less than a month later, Wagenius was arrested and charged in two separate federal indictments. He soon pleaded guilty to all counts in both cases.

Federal prosecutors said Wagenius had help in his extortion campaign. Kenneth Schuchman, 28, of Vancouver, Washington, assisted the effort. Schuchman has a lengthy cybercriminal history of his own. In 2019, he pleaded guilty to operating the Satori botnet, a sprawling collection of hacked Internet-of-Things devices used to launch large-scale distributed denial-of-service attacks.

Two other alleged co-conspirators still face charges tied to the Snowflake data thefts. Conor Riley Moucka, known online as "Judische," of Kitchener, Ontario, was arrested in 2024 and pleaded guilty in August 2026. John Erin Binns, an American living in Turkey, is also wanted for a 2021 data breach at T-Mobile that exposed personal information belonging to at least 76 million customers.

A Ransom, a President, and the NSA

The extortion operation had a political dimension that raised alarms far beyond corporate security teams. Kiberphant0m admitted to re-extorting victims and threatening to disclose national security secrets. Immediately after Moucka's arrest, and after AT&T had already paid the extortion group a $370,000 Bitcoin ransom, Kiberphant0m posted what he claimed were AT&T call logs for then President-elect Donald Trump and then Vice President Kamala Harris. He also posted schematics allegedly stolen from the National Security Agency.

"We don't often get leads where there's an active duty soldier with a secret clearance who's creating hacking tools and trafficking in data. That doesn't happen every day, and so when that hits it really spins all of our partner organizations up. It was very serious from jump street, just because it was unique, it was an insider threat, and we weren't sure what we were dealing with."

Those words came from Paul Russell, a resident agent in charge at the Defense Criminal Investigative Service, the criminal investigative arm of the U.S. Department of Defense Office of Inspector General. Russell said his agency worked the investigation alongside the FBI, the Army Criminal Investigative Division, and the U.S. Secret Service once it learned a soldier with secret clearance was allegedly involved in cybercrime and extortion.

Bad Behavior Behind Bars

Wagenius pleaded guilty almost immediately. He cooperated very well, according to prosecutors. But then he got caught trying to find security vulnerabilities in the Bureau of Prisons' own computer network, which is exactly the kind of thing that makes you wonder what he was thinking, because it's not as if they'd just hand him a fresh chance and forget the whole thing.

A sentencing memo filed September 19 in Seattle details how Wagenius violated BOP computer use policies while incarcerated and awaiting sentencing. He wanted a CVE list. And he wanted a working script for each one, with no omitted code. Around September 2025, he used another inmate's email system to ask a recipient to prompt a commercial AI tool for information about Windows 10 Enterprise privilege escalation and bypasses. That's what he asked for.

Less than a week later, he used a different inmate's email account. He wanted step-by-step instructions for CVE-2023-45208. That's a three-year-old command injection vulnerability in D-Link networking devices. He asked for code and told the recipient to write some if none existed, describing everything in detail. And that same month, he allegedly asked how to build an antenna in a prison environment using commissary items, and requested research on escaping prison, which is a lot to fit into one month behind bars.

Prosecutors noted that in several instances Wagenius framed the AI queries as research for a book he was writing, a common method of prompt injection where attackers feed deceptive inputs into commercial AI tools programmed to avoid outputting malicious code.

The government told the court something simple. It was unaware. Unaware of evidence that Wagenius figured out how to use or deploy the vulnerabilities in BOP systems. When questioned, he said he was only researching potential vulnerabilities to provide information to the BOP.

The Money Never Came

Here is where the story takes a turn that almost defies belief. Despite the enormous financial value of the data stolen from AT&T and other telecom providers, the US soldier AT&T Verizon extortions yielded almost nothing. The government's sentencing memo says Wagenius made a whopping total of around $1,500 from selling stolen data.

The memo states plainly that while Wagenius was not particularly financially successful as a cybercriminal, he both intended to and did cause serious harm to numerous individual victims, U.S. Companies, and the U.S. Government. The dollar figure was small. The damage was not.

Prosecutors described a man who threatened national security. He exposed private call records. They belonged to a president-elect and a vice president. And he tried to exploit prison computer systems while he waited for his sentence, which is the kind of conduct that turns a routine fraud case into something far more serious than anyone involved likely expected when the investigation first began. The 70-month term and $294,978 restitution order reflect the gap between what he earned and what he cost. That's it. We've got the numbers. They don't lie.

FAQ

What were the US soldier AT&T Verizon extortions?
Cameron Wagenius, using the handle Kiberphant0m, stole call and text metadata from AT&T and Verizon customers via exposed Snowflake accounts, then demanded payment to keep the data private.

How long was Cameron Wagenius sentenced to prison?
A Seattle judge sentenced him to 70 months in federal prison and ordered $294,978 in restitution to victims.

How much money did the extortion scheme actually make?
According to the government's sentencing memo, Wagenius earned only around $1,500 from selling stolen data despite the scale of the breach.

For the telecom industry, the case closes a chapter that began with weak authentication practices at a cloud provider and cascaded into one of the more embarrassing insider threat cases in recent memory. For Wagenius, the sentence is a reminder that a secret clearance and a hacker handle do not mix.