US prosecutors have formally linked the arrest of a US Army soldier in December to a massive theft of US phone records from AT&T and Verizon last year.

Authorities arrested Cameron John Wagenius, a US Army communications specialist, in Texas on December 20 after a brief two-page grand jury indictment charged the US serviceperson with two counts of unlawfully transferring confidential telephone records. Wagenius was later extradited to Washington state.

In a new court filing on Friday, US prosecutors confirmed that the charges against Wagenius are related to the earlier indictment of two alleged hackers, Connor Moucka and John Binns, which the US government indicted many intrusions in the cloud computing company Snowflake which has seen many thefts of data stored on its customer accounts. Snowflake customers whose data was stolen include AT&T, which had “almost all” of its customer call records through 2024 exfiltrated from its Snowflake account, and Verizon, which had a large cache of logs removed on the customer’s call.

US Attorney Tessa Gorman told the court in Seattle that, “both cases stem from the same computer hacking and extortion and involve some of the same stolen victim information,” and thus, “these cases rely on overlapping evidentiary material and legal process and may present general questions of law and fact.”

It was the first public acknowledgment by prosecutors that Wagenius’ charges were connected to breaches last year at cloud computing company Snowflake. Security reporter Brian Krebs first reported at the link between Wagenius and the Snowflake hacks in November, and later broke the news on the capture of Wagenius.

The Snowflake account hacks became one of the most widespread cyber attacks of the past year, affecting AT&T, LendingTree, Santander Bank, Ticketmasterand at least 160 other companies. Hackers allegedly stole large banks of personally identifiable and sensitive corporate data stored by Snowflake companies, in part using passwords stolen from employee computers with malware. Most of the affected Snowflake customers were not using multi-factor protection, which Snowflake did not require of its customers at the time.

According to Krebs’ report, following the prior to Moucka’s arrest by Canadian authoritiesWagenius admitted in a post on a known cybercrime forum that he had access to the call logs of Vice President Kamala Harris and then-President-elect Donald Trump, and threatened to leak all the stolen files except if Moucka is released.

Prosecutors accused the Snowflake hackers of stealing data that included personal information, cell phone and IMEI numbers, dates of birth, postal and email addresses, passwords, Social Security numbers, government-issued identification numbers, as well as payment card and bank account numbers.

Wagenius was ordered on Jan. 8 to be jailed, and is understood to be in Washington state custody.