Former U.S. Army member, Cameron John Wagenius, 22, was sentenced after he pled guilty to hacking several telecommunications companies and leaking records. Wagenius received a 70-month sentence and was ordered to pay nearly $295,000 in restitution.
Wagenius was on active duty, stationed in South Korea and in Texas when he orchestrated the cyberattacks in April 2023 and December 2024.
His scheme involved obtaining login credentials at telecommunications companies and using them to breach their systems. Then, he sought millions in ransom for the data he stole. Wagenius made ransom demands both publicly and privately, making two online posts, claiming he had confidential data that he would release if he was not paid a ransom. He also attempted to sell the stolen information to a foreign intelligence service.
One of Wagenius' attacks was on AT&T, which involved metadata including nearly all call logs and texts made by customers over a six-month period and other personal identification information. Wagenius carried out this attack by targeting a data storage company, Snowflake.
Wagenius also breached the systems using a tool he created called SSH Brute. Before being caught, Wagenius was able to successfully sell at least some of the stolen data and used it to carry out other fraud schemes.
Source: https://therecord.media/hacker-telecom-army-sentenced
Commentary
In some ransomware cases, an employee is privately notified that their data was compromised, and that a ransom is due to release the data. The compromised data could also include organizational data. The employee who receives a ransom demand, claiming data has been stolen, may feel embarrassed, may fear job loss, or may fear negative consequences related to a cybersecurity mistake.
That concern and reluctance to report can make private threats more difficult for organizations to discover and address.
Organizations should communicate to staff that receiving a ransomware demand is not itself misconduct and that prompt, good faith reporting of such communications is required. Supervisors who receive such reports should be trained to respond calmly and report the matter to the proper designated response teams.
Absolute confidentiality or total immunity from consequences should not be promised when an employee makes a report. Organizations may still address employee misconduct that led to a breach. However, limit information about the breach only to those that require it, and ensure that an investigation into the breach cause is investigated fairly.
The final takeaway is organizations should remove barriers to reporting lapses in cybersecurity measures, including making employees feel safe reporting ransom demands.
