U.S. Army Soldier Sentenced for Massive Telecom Metadata Theft

A 22-year-old U.S. Army soldier has been sentenced to 70 months in federal prison for orchestrating a series of cyberattacks and extortion attempts against major telecommunications providers. Cameron John Wagenius, who operated under the cybercriminal persona “Kiberphant0m”, was also ordered to pay $294,978 in restitution to his victims.

The sentencing, which took place in Seattle, follows Wagenius’s guilty plea regarding the theft of sensitive information belonging to millions of users.

Exploitation of Cloud Storage Vulnerabilities

Prosecutors established that Wagenius, who was stationed at a U.S. Army base in South Korea during the attacks, targeted customers of the Snowflake cloud data storage service. He specifically exploited accounts that had exposed credentials and had not enabled multi-factor authentication (MFA).

In October 2024, Wagenius claimed to have stolen call and text metadata, including source and destination numbers, timestamps, and call durations, for more than 100 million AT&T customers. He also claimed to have accessed the systems of over a dozen telecommunications companies worldwide, including Verizon’s Push-to-Talk business.

Extortion and National Security Threats

Wagenius attempted to extort multiple telecommunications firms by threatening to release stolen data in exchange for payment. During these attempts, he made several high-profile threats, including claims that he possessed the call logs of then President-elect Donald Trump and then Vice President Kamala Harris.

He also allegedly threatened to disclose stolen schematics from the U.S. National Security Agency (NSA). Despite the scale of the data theft, prosecutors noted that his direct financial gains from selling the stolen data were relatively low, totaling approximately $1,500.

Insider Threat and AI Exploitation Attempts

The case drew significant attention from federal agencies because Wagenius was an active-duty soldier with a secret security clearance. Paul Russell, a resident agent in charge at the Defense Criminal Investigative Service (DCIS), stated that the possibility of an insider threat with such access necessitated a large-scale investigation involving the FBI, the U.S. Secret Service, and the Army Criminal Investigative Division (CID).

While awaiting sentencing, Wagenius reportedly attempted to use commercial artificial intelligence (AI) tools to identify vulnerabilities within the Bureau of Prisons (BOP) computer network. According to a sentencing memo, he used other inmates’ email accounts to conduct “prompt injection” attacks, using deceptive inputs to attempt to bypass AI safety protocols to obtain exploit code for Windows 10 and specific vulnerabilities, such as CVE-2023-45208.

Wagenius’s legal proceedings follow the arrest of several alleged co-conspirators. Conor Riley Moucka, who pleaded guilty in August 2026, and John Erin Binns, who remains wanted, were also implicated in connection with the Snowflake data thefts.