U.S. Soldier Gets 70 Months in Prison for AT&T, Verizon Extortions

Cameron Wagenius was a U.S. Army soldier stationed in South Korea who hacked telecommunications companies and Snowflake customers. Using the name “Kiberphant0m,” he stole call and text metadata, threatened companies, and sought ransom payments. The crimes mattered because they affected millions of customers and involved a service member with secret clearance.

The attacks included data from more than 100 million AT&T customers. Wagenius also claimed to have breached more than a dozen telecommunications companies, including Verizon’s Push-to-Talk business. He pleaded guilty in two federal cases and admitted extortion, re-extortion, and threats involving alleged national security secrets.

A federal court sentenced him to 70 months in prison and ordered $294,978 in restitution. Prosecutors also noted that he tried to obtain information about vulnerabilities in Bureau of Prisons computer systems while awaiting sentencing. That conduct showed continued cybersecurity activity despite his incarceration.

The largest stated figure is more than 100 million AT&T customers whose mobile call and text metadata was stolen in 2024. Metadata can reveal communication patterns, making a breach serious even when the message or conversation itself is not included. Wagenius also claimed he stole data from tens of millions of AT&T customers and hacked other telecommunications companies.

The stolen material included source and destination numbers, timestamps, and call duration. Those details can show who contacted whom, when communication occurred, and how long a call lasted. The article does not state that Wagenius obtained the actual content of every call or text.

At sentencing, the court ordered Wagenius to pay $294,978 in restitution to victims. The article separately reports that AT&T had already paid the extortion group a $370,000 Bitcoin ransom before the group posted alleged AT&T call logs.

Call and text metadata is information about a communication rather than its substance. It can include the source number, destination number, date or time, and call duration. These details can expose relationships and communication habits, even without revealing the conversation or message itself.

For example, a record might show that one phone number contacted another at a particular time and that the call lasted ten minutes. It would not necessarily show what either person said. The article identifies source and destination numbers, timestamps, and duration as examples of the stolen metadata.

That distinction matters because metadata can still be sensitive and useful for extortion. The article reports that Wagenius claimed to have posted call logs for then President-elect Donald Trump and then Vice President Kamala Harris. It does not state that the content of those calls was published.

The attackers used stolen data as leverage. They publicly threatened telecommunications companies with disclosure and demanded payment in exchange for promises not to publish the information. This turned unauthorized access into an extortion campaign involving several large companies.

Kiberphant0m claimed to have hacked more than a dozen telecommunications companies worldwide, including Verizon’s Push-to-Talk business. After AT&T had already paid the group a $370,000 Bitcoin ransom, Kiberphant0m posted what he claimed were call logs for Donald Trump and Kamala Harris. He also allegedly threatened to disclose national security secrets and re-extorted victims.

The campaign showed that payment did not guarantee the attackers would keep their promises. The article reports that Kiberphant0m publicly extorted companies and repeatedly threatened disclosure. Several alleged co-conspirators faced charges, while Wagenius pleaded guilty and was sentenced to prison.

Credentials are the account details used to sign in, such as a username and password. When those details are exposed, attackers may be able to enter an account by using them directly. Multi-factor authentication, or MFA, adds another verification step, making a stolen password less useful by itself.

The article says Kiberphant0m and alleged co-conspirators downloaded data from Snowflake customers whose credentials were exposed and whose accounts did not enforce MFA. That combination created a simpler path into the accounts. Once inside, the attackers accessed data held by several large customers.

Snowflake has since mandated MFA on all accounts. The change addresses the specific weakness described in the article, although it does not erase the earlier thefts or recover exposed data. The case demonstrates why both protected credentials and an additional login check matter for cloud-stored information.

Multiple agencies investigated because the alleged conduct involved both civilian cybercrime and a U.S. military insider threat. The FBI handled federal investigative work, while Army Criminal Investigation Division examined the soldier’s military connection. DCIS investigates crimes involving the Defense Department, and the Secret Service also joined the investigation.

Paul Russell of DCIS said the investigation began after the agency received information that a soldier with secret clearance was allegedly involved in cybercrime and extortion. Investigators worked together after learning that the soldier was creating hacking tools and trafficking in data. The alleged activity affected telecommunications companies and included claimed national security secrets.

The cooperation reflected the unusual combination of roles and risks. Wagenius was stationed at a U.S. Army base in South Korea, and the agencies were unsure of the full scope at first. Their work led to his arrest, two federal indictments, and his guilty pleas.

An insider threat is a danger posed by someone connected to an organization who may have authorized access, trusted status, or specialized knowledge. The risk is different from an outside attacker because the person’s role can provide access or credibility. In this case, the concern involved an active-duty soldier accused of cybercrime and extortion.

Wagenius was stationed at a U.S. Army base in South Korea and had secret clearance. Investigators said he was creating hacking tools, trafficking in data, and threatening to disclose national security secrets. Kiberphant0m also posted what he claimed were schematics stolen from the NSA. The article does not establish that every claim was authentic.

Paul Russell called the situation unique and serious because it involved an active-duty soldier with secret clearance. The investigation therefore included DCIS, the FBI, Army CID, and the Secret Service. Wagenius was arrested, pleaded guilty, and received a 70-month prison sentence.