{"id":10427,"date":"2026-08-10T07:30:22","date_gmt":"2026-08-10T11:30:22","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=10427"},"modified":"2026-08-09T19:12:08","modified_gmt":"2026-08-09T23:12:08","slug":"how-one-missing-security-setting-led-to-100-million-stolen-records","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/","title":{"rendered":"How one missing security setting led to 100 million stolen records"},"content":{"rendered":"<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">A 26-year-old Canadian man pleaded guilty this week to charges tied to one of the largest data theft campaigns in recent memory, a scheme that started with something surprisingly ordinary: accounts that simply didn&#8217;t have multi-factor authentication turned on.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Authorities arrested Connor Riley Moucka, who also went by Alexander Moucka and the online handle Waifu, back in October 2024. Prosecutors say that between February and October of that year, Moucka and co-defendant John Erin Binns broke into customer accounts on <a href=\"https:\/\/www.snowflake.com\/en\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Snowflake<\/a>, the cloud storage provider, using login credentials they stole through infostealer malware. Because those particular accounts had no MFA protection, a correct username and password was all it took to get in.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">From there, the pair reportedly used custom software to sift through massive amounts of stored data, picking out whatever looked valuable: banking details, payroll records, Social Security numbers, driver&#8217;s license and passport numbers, DEA registration numbers, and call and text history. After pulling terabytes of data out of victims&#8217; Snowflake environments, they tried extorting companies directly and collected at least $2.5 million in bitcoin from three victims. They also sold stolen data on hacker forums, pulling in another $495,000 or so through those sales.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">One detail stands out even among the rest of the case. According to the Department of Justice, Moucka extorted one victim a second time, using stolen personal data belonging to a government officer&#8217;s family members as leverage.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">The scale here is hard to overstate. The DOJ says the breaches affected more than 100 million people, and victim companies collectively lost over $9.5 million. The list of impacted organizations reads like a roundup of household names: AT&amp;T, Ticketmaster, Santander, Pure Storage, Advance Auto Parts, Los Angeles Unified, QuoteWizard, and Neiman Marcus, among others.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Moucka pleaded guilty to four counts, including computer fraud and aggravated identity <a href=\"https:\/\/hostingdiscussion.com\/news\/cyber-threat-surge-puts-dns-firewalls-at-the-center-of-global-network-defense\/\">theft<\/a>, and faces up to 32 years in prison when he&#8217;s sentenced on October 27. Authorities arrested Binns in Turkey, where an extradition request from U.S. prosecutors is still working its way through the courts.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">In response to the breaches, <a href=\"https:\/\/hostingdiscussion.com\/news\/snowflake-moves-to-bolster-observability-after-outages-with-observe-deal\/\">Snowflake<\/a> has since started enforcing MFA and requiring longer, 14-character minimum passwords.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A 26-year-old Canadian man pleaded guilty this week to charges tied to one of the largest data theft campaigns in recent memory, a scheme that started with something surprisingly ordinary: accounts that simply didn&#8217;t have multi-factor authentication turned on. Authorities arrested Connor Riley Moucka, who also went by Alexander Moucka and the online handle Waifu, [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[71],"tags":[1870,7661,3236,282,2704,3238],"class_list":["post-10427","post","type-post","status-publish","format-standard","hentry","category-featured","tag-cloud-storage","tag-connor-riley-moucka","tag-cyberattack","tag-data-breach","tag-multi-factor-authentication","tag-snowflake"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How one missing security setting led to 100 million stolen records - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How one missing security setting led to 100 million stolen records - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"A 26-year-old Canadian man pleaded guilty this week to charges tied to one of the largest data theft campaigns in recent memory, a scheme that started with something surprisingly ordinary: accounts that simply didn&#8217;t have multi-factor authentication turned on. Authorities arrested Connor Riley Moucka, who also went by Alexander Moucka and the online handle Waifu, [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-10T11:30:22+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-09T23:12:08+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/\",\"name\":\"How one missing security setting led to 100 million stolen records - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-08-10T11:30:22+00:00\",\"dateModified\":\"2026-08-09T23:12:08+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How one missing security setting led to 100 million stolen records\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How one missing security setting led to 100 million stolen records - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/","og_locale":"en_US","og_type":"article","og_title":"How one missing security setting led to 100 million stolen records - Web Hosting News","og_description":"A 26-year-old Canadian man pleaded guilty this week to charges tied to one of the largest data theft campaigns in recent memory, a scheme that started with something surprisingly ordinary: accounts that simply didn&#8217;t have multi-factor authentication turned on. Authorities arrested Connor Riley Moucka, who also went by Alexander Moucka and the online handle Waifu, [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/","og_site_name":"Web Hosting News","article_published_time":"2026-08-10T11:30:22+00:00","article_modified_time":"2026-08-09T23:12:08+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/","url":"https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/","name":"How one missing security setting led to 100 million stolen records - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-08-10T11:30:22+00:00","dateModified":"2026-08-09T23:12:08+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/how-one-missing-security-setting-led-to-100-million-stolen-records\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"How one missing security setting led to 100 million stolen records"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":115,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10427","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=10427"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10427\/revisions"}],"predecessor-version":[{"id":10428,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10427\/revisions\/10428"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=10427"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=10427"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=10427"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}