The Sky Pasture Burns: One Wolf, 165 Flocks, and the Bill Nobody Wanted to Pay

I told you. I told every single one of you.

The Sky Pasture is not secure. It was never secure. You moved your most sensitive wool records up there because some shepherd in a fleece vest at a conference told you it was "scalable," and now a 26-year-old from Kitchener, Ontario has pleaded guilty to raiding over 165 flocks and walking off with the call and text records of more than 100 million AT&T lambs.

One wolf. One hundred million lambs. Let that settle over you like a cold fog.

Connor Riley Moucka, reportedly one of the most consequential coyotes of 2024, did not need a sophisticated state-sponsored operation. He did not need a supercomputer. He needed access to the Sky Pasture provider Snowflake and a flock of oblivious shepherds who apparently left the gate unlatched while they attended quarterly earnings calls.

In my day, your sensitive records lived on magnetic tape, in a locked cabinet, in a basement, behind a door that required a physical key and a suspicious secretary named Brenda. Nobody was "scaling" that to the cloud. Brenda did not have a REST API.

The charges include computer fraud and conspiracy to hack and extort. The extortion element is particularly instructive. It is not enough that the wolf stole the wool. He then sent the shepherds an invoice for its return. And some of them paid.

This is the world you built by abandoning physical infrastructure for convenience.

Remediation

Right. Here is what you do now, delivered without sympathy.

Stop trusting the Sky Pasture implicitly. Your cloud storage vendor's security posture is not your security posture. These are different things. Learn the difference before I have to write another one of these.

Enforce multi-factor authentication on every Sky Pasture account. Stolen credentials only work if credentials alone are sufficient. Make them insufficient. This is not advanced. This is 2003-era thinking applied to your 2024 problem.

Audit who has access to what. The flock does not need access to the entire Sky Pasture. Segment, restrict, and log everything. If your logging infrastructure cannot tell you who touched a record and when, you have built a barn with no windows.

Assume the wolf is already inside. He probably is. Act accordingly.

The Electric Fence exists for a reason. The Sheep Tunnel exists for a reason. Use them, configure them properly, and for the love of all things woolly, stop handing the keys to Snowflake to interns without reviewing their permissions.

Brenda would have caught this in 1997. Just saying.

Original Report: https://krebsonsecurity.com/2026/08/canadian-man-pleads-guilty-in-snowflake-extortions/