Connor Riley Moucka, 26, of Kitchener, Ontario, pleaded guilty Wednesday to a widespread computer hacking conspiracy that resulted in the compromise of over 165 victim organisations, the theft of billions of sensitive customer records and the extortion of numerous victims.

According to court documents, between February and October 2024, Mr Moucka and his co-conspirators used stolen login credentials to compromise cloud-hosted data belonging to at least 165 customers of a U.S.-based software-as-a-service company.

Mr Moucka and others used their unauthorised access to these customers’ computer systems to steal billions of sensitive customer records and download terabytes of information, including individuals’ non-content call and text history records, banking and other financial information, payroll records, Drug Enforcement Administration registration numbers, driver’s licence numbers, passport numbers, social security numbers and other personally identifiable information.

They then extorted victims by threatening to publish data online.

The conspirators profited from the scheme, receiving over $2.5 million in ransom payments. In at least one instance, Mr Moucka re-extorted a victim with threats of further disclosure of the victim’s stolen data.

Mr Moucka used the stolen data of a government officer and members of a then-former government officer’s immediate family in this re-extortion attempt.

In addition to extorting victims, Mr Moucka and his co-conspirators advertised the victims’ data for sale online, including on the cybercrime forums BreachForums, Exploit.in and XSS.is, as well as on Telegram.

Through these actions, Mr Moucka personally obtained at least $495,000. The harm to the conspirators’ victims was much greater, with victim companies suffering over $9.5 million in actual losses—a number that does not include losses suffered by the companies’ customers, totalling at least 100 million individuals.

Mr Moucka pleaded guilty to four counts of the indictment, including computer fraud, wire fraud, aggravated identity theft, and a related conspiracy.

He is scheduled to be sentenced on October 27. He faces a mandatory minimum penalty of two years in prison on the aggravated identity theft count and a maximum penalty of 30 years in prison on the remaining counts.