Mounties reportedly bust Ticketmaster, AT&T hacker

The perpetrator, allegedly responsible for penetrating multiple Snowflake cloud storage accounts, was arrested in Canada, 404 Media has reported. The attackers’ actions caused some of of this year’s largest data breaches.

Alexander Connor Moucka was reportedly arrested in Canada by the Royal Canadian Mounted Police (RCMP). Mounties cuffed the attacker, known by the aliases Judische and Waifu on the dark web, on the day before Halloween.

Moucka was supposedly behind the Snowflake-related data breaches. According to a report from cybersecurity firm Mandiant, attackers used multiple infostealer malware campaigns to infect customer systems and later, using stolen credentials, systematically compromised instances at Snowflake.

Over a hundred Snowflake accounts were accessed, including market behemoths such as Ticketmaster, AT&T, Santander Bank, and Advance Auto Parts. The Ticketmaster breach alone exposed over half a billion individuals.

While Snowflake’s systems were not directly breached, many impacted client accounts were only protected by a single-factor authentication, meaning that obtaining a password was enough to access the account. Earlier this year, Mandiant credited the attack to UNC5537, a financially motivated threat actor.

“Mandiant assesses with moderate confidence that UNC5537 comprises members based in North America, and collaborates with an additional member in Turkey,” reads the report.

The exact nature of the charges and Moucka's profile have not been revealed just yet. We have contacted the Canadian Ministry of Justice for comment about Moucka‘s arrest and will update the article once we receive a reply.

It’s estimated that the Snowflake attacks exposed 165 companies, with attackers roaming their customer environments for days. Around 30 million Santander customers were exposed, while Advance Auto Parts said the attack cost it millions of dollars.

Carrying out notable hacker attacks doesn't seem to be a winning strategy, as UK authorities arrested a 17-year-old attacker suspected of being behind the breach of MGM Resorts in America.

In June, a 22-year-old UK national was arrested in Spain. Researchers believe the hacker was intimately involved in the MGM Resorts International cyberattack.