Hacker in Snowflake Extortions May Be a U.S. Soldier

This KrebsOnSecurity investigation documents a large criminal campaign that harvested Snowflake account credentials (often accounts protected only by username/password) to steal and extort sensitive datasets from dozens of organizations — notably AT&T (≈110M records). The piece profiles the prolific threat actor "Kiberphant0m" (and linked aliases such as Reverseshell, Buttholio, Vars_Secc), outlines their sales/leaks of stolen data, SIM-swapping and DDoS/IoT botnet activity, and notes arrests of two suspects while the primary actor remains at large and continues public extortion.