US Soldier Jailed for 70 Months After Stealing Telco Data Through Weak Cloud Account Security

Cameron John Wagenius, 22, was sentenced in Seattle to 70 months in federal prison and ordered to pay $294,978 in restitution. He pleaded guilty to hacking several telecommunications companies and stealing mobile call and text metadata for more than 100 million AT&T customers in 2024. The metadata included details such as source and destination numbers, timestamps and call duration. Wagenius was stationed at a US Army base in South Korea and operated online under the persona "Kiberphant0m".

According to the report, he and three alleged co-conspirators downloaded data from several large customers of the cloud data storage service Snowflake. Those customers had exposed credentials and did not enforce multi-factor authentication (MFA). Snowflake has since mandated MFA on all accounts. In October 2024, Kiberphant0m boasted on cybercrime forums about the AT&T theft, claimed to have breached more than a dozen telecommunications companies worldwide, including Verizon's Push-to-Talk business, and publicly extorted them in exchange for not publishing the stolen data.

KrebsOnSecurity warned in late November 2025 that Kiberphant0m was likely a US soldier in South Korea. Less than a month later, Wagenius was arrested and charged in two federal indictments, then pleaded guilty to all counts. Prosecutors said he was assisted by Kenneth Schuchman, 28, of Vancouver, Washington, who pleaded guilty in 2019 to operating the Satori botnet, a large network of hacked Internet-of-Things devices used for DDoS attacks.