Kitchener, Ont., man arrested in massive Snowflake hacking scheme faces possible extradition to U.S.

A Kitchener, Ont., man accused of taking part in a massive hacking scheme affecting cloud storage provider Snowflake has been arrested and may be extradited to the United States.

Connor Moucka, 25, was arrested on Oct. 30 at his Stanley Park area home on a provisional warrant following a request by U.S. authorities.  

Moucka — alleged to be the person also known as Alexander Moucka, judische, catist, ellyel8 and waifu in the criminal investigation — is accused of being a co-conspirator along with John Binns, a resident of Turkey also known as irdev and j_irdev1337. 

Indictment documents also obtained by CBC suggest others beyond Moucka and Binns may have been involved in the scheme to "hack into at least 10 victim organizations' protected computer networks."

Snowflake, which reported the data breach to U.S. authorities several months ago, is an American-based data storage company, with customers including telecommunications giant AT&T, Live Nation's Ticketmaster and Santander Bank. 

According to an unsealed arrest warrant obtained by CBC from the Superior Court of Justice in Kitchener, the United States District Court for the Western District of Washington issued the warrant for Moucka's arrest on Oct. 29.

He's accused of conspiracy, computer fraud and abuse, extortion in relation to computer fraud, wire fraud and aggravated identity theft. No charges have been laid. His case was remanded to Friday for an update on his legal aid status. 

The indictment documents allege Moucka and Binns "profited from these schemes through several means, including by successfully extorting at least 36 bitcoin (worth approximately $2.5 million at the time of payment) from at least three victims."

The warrant also says Moucka's arrest was necessary in the public interest.

"On Nov. 12, Mr. Moucka indicated that he is still waiting for a decision from legal aid," Ian McLeod, senior adviser of media relations with the Department of Justice Canada, said in an emailed statement to CBC.

"As extradition requests are considered confidential state-to-state communications, we cannot comment further on this case."

The U.S. Department of Justice declined to comment. CBC reached out to the jail where Moucka is currently being held but was denied communication. He is not yet represented by a lawyer.

On May 30, Snowflake posted a notice to its website acknowledging it was aware of a possible compromise of the company's online data.

Cybersecurity organizations Crowdstrike and Mandiant Consulting, which is part of Google Cloud, were hired to investigate.