Moucka Guilty Plea Confirms Snowflake MFA Failures Enabled 165+ Breaches

Moucka, operating as Judische and Waifu, exploited stolen credentials on accounts without MFA to access cloud instances holding PII, financial records, and DEA numbers. The Justice Department filing details over $2.5 million in ransom collections and at least one re-extortion using a government official's family data. Court records show repeated nickname rotation and direct harassment of investigators, patterns also seen in co-conspirator Cameron Wagenius's operations against Verizon and AT&T.

Procurement and incident timelines reveal Snowflake's delayed enforcement of MFA until after the breaches, despite prior warnings in KrebsOnSecurity reporting from September 2024. Cross-referenced RCMP affidavits and DOJ statements confirm Moucka's role in voice phishing campaigns dating to 2020, linking English-speaking actors to data resale markets. Independent technical traces of Judische handles match the admitted timeline without state attribution claims.

The case exposes persistent gaps in SaaS access controls and the limits of post-breach remediation. Moucka's guilty plea on fraud and conspiracy counts follows Wagenius's July 2025 admission, suggesting coordinated targeting of telecom and cloud providers. Legal outcomes will test whether re-extortion enhancements and victim harassment elevate sentencing beyond standard cybercrime ranges.

Sentencing is scheduled after Wagenius's September 2026 hearing; expect further indictments if remaining co-conspirators are identified through seized Telegram and Discord logs.