Investigation: a third suspect behind the Snowflake client hacks, hacker Kiberphant0m, may be a US Army soldier who is or was recently stationed in South Korea
Two men have been arrested for allegedly stealing data from and extorting dozens of companies that used the cloud data storage company Snowflake …
Context & Ripple Effects
The suspected third participant emerges from a case already expanded beyond a single intrusion: a U.S. indictment had alleged that two suspects and co-conspirators extorted at least 36 bitcoin from Snowflake customers, including AT&T. Earlier, a criminal site had advertised hundreds of allegedly stolen Snowflake customer credentials, putting the exposure in the context of customer-account compromise rather than a narrowly contained incident.
The reported military connection matters chiefly as a new lead in attribution and prosecution. It also foreshadows the later arrest of a soldier suspected of being Kiberphant0m, while remaining an allegation at this point in the coverage.
First-order effects
- Investigators gain a potential identity and service affiliation for an alleged third participant, which could broaden the criminal investigation beyond the two already arrested suspects.
- Snowflake customers tied to the campaign face renewed scrutiny of the alleged theft-and-extortion operation, while the U.S. Army may need to assess the reported connection to a current or recent service member.
Second-order effects
- A potential third suspect could strengthen investigators’ ability to map roles, stolen-data distribution, and extortion proceeds around the conduct described in the Snowflake-client indictment.
- The case keeps pressure on cloud customers to treat exposed credentials as an operational risk: advertised credential inventories can enable repeated targeting even after initial incidents become public.
Third-order effects
- If similar cases continue to involve dispersed collaborators with institutional affiliations, cybercrime investigations will increasingly require coordination between corporate victims, civilian law enforcement, and affected institutions rather than focusing only on the initial breach.
- The broader lesson is that identity and credential controls at cloud customers can become the decisive security boundary, shifting attention from a provider-centric breach narrative to shared responsibility for account protection.
The trend: Cloud-data incidents are increasingly being investigated as credential-driven, multi-actor crime campaigns whose impact extends from victim companies to the institutions connected to alleged perpetrators.