US soldier sentenced to 70 months for AT&T, Verizon extortion

September 26, 2026 at 03:35 AM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Cameron John Wagenius, a 22-year-old U.S. Army soldier, was sentenced to 70 months in federal prison and ordered to pay $294,978 in restitution for hacking telecom companies and extorting them. He pleaded guilty to stealing call and text metadata of more than 100 million AT&T customers in 2024. Wagenius operated as 'Kiberphant0m' while stationed in South Korea.

Key Facts

Cameron John Wagenius, 22, was sentenced to 70 months in federal prison and ordered to pay $294,978 in restitution.
Wagenius stole call and text metadata for more than 100 million AT&T customers in 2024.
He operated under the alias 'Kiberphant0m' while stationed at a U.S. Army base in South Korea.
Co-conspirator Kenneth Schuchman, 28, of Vancouver, Washington, has a prior conviction for operating the Satori botnet.
AT&T paid a $370,000 Bitcoin ransom to the extortion group before Kiberphant0m posted alleged call logs of Donald Trump and Kamala Harris.

Sentencing and Restitution

Cameron John Wagenius, 22, was sentenced to 70 months in federal prison at a hearing in Seattle. He was ordered to pay $294,978 in restitution to victims. Wagenius pleaded guilty to all counts in two separate federal indictments. He was arrested in December 2025, less than a month after KrebsOnSecurity identified him as likely being a U.S. soldier in South Korea.

The Hacking and Extortion Scheme

Wagenius, using the alias 'Kiberphant0m', downloaded data from Snowflake customers with exposed credentials and no multi-factor authentication. In October 2024, he claimed on cybercrime forums to have stolen call and text metadata for tens of millions of AT&T customers. He publicly extorted more than a dozen telecommunications companies, including Verizon's Push-to-Talk business, threatening to publish stolen data. After AT&T paid a $370,000 Bitcoin ransom, Kiberphant0m posted alleged call logs of then President-elect Donald Trump and Vice President Kamala Harris, along with schematics allegedly stolen from the NSA.

Co-Conspirators and Related Cases

Federal prosecutors said Wagenius was assisted by Kenneth Schuchman, 28, of Vancouver, Washington, who has a lengthy cybercriminal history. Schuchman pleaded guilty in 2019 to operating the Satori botnet, used for large-scale DDoS attacks. Conor Riley Moucka, also known as 'Judische', of Kitchener, Ontario, was arrested in 2024 and pleaded guilty in August 2026. John Erin Binns, an American living in Turkey, is wanted for a 2021 T-Mobile breach that exposed data of at least 76 million customers.