A U.S. Army soldier was arrested for allegedly attempting to sell the stolen call logs of President-elect Donald Trump and Vice President Kamala Harris, according to Krebs on Security, an online publication run by former Washington Post reporter Brian Krebs.
Federal authorities indicted Cameron John Wagenius, 20, last month on two counts of unlawful transfer of confidential phone records information, court documents show.
The brief indictment, originally filed in the U.S. District Court for the Western District of Texas in Waco, doesn’t offer specifics about the allegations, including victims’ names or alleged activities. It also excludes personal information about Wagenius.
However, Wagenius, which Krebs on Security identified as a U.S. soldier, is believed to be “Kiberphant0m,” a cybercriminal who’s made a name for himself online in dark web forums by selling and leaking stolen personal information from AT&T and Verizon customers, according to the report.
Wagenius was arrested near Fort Cavazos, Texas, on Dec. 20, according to Krebs on Security.
Last July, AT&T announced sensitive data was breached two years prior by hackers who leaked customer calls and text records from May to October 2022 onto the dark web. The telecommunications company said at the time that the information, which was accessed through third-party cloud platform Snowflake, did not contain Social Security numbers.
Krebs, who’s reported extensively on the data breach and those allegedly responsible, interviewed Wagenius’ mother, Alicia Roen, who said Wagenius worked on radio signals and network communications at a U.S. Army base in South Korea.
RELATED
Two other individuals — Connor Riley Moucka and John Erin Binns — have been arrested and indicted in connection to allegedly accessing and stealing AT&T customer data and extorting customers afterward, according to federal court documents.
Moucka and Binns were both indicted with one count of conspiracy, five counts of computer fraud and abuse, two counts of extortion in relation to computer fraud and 10 counts of wire fraud. The indictment alleges the two hacked into protected computer networks, stole sensitive information, extorted victims for ransom by threatening to sell their personal information online and in total racked up 36 bitcoins, the equivalent of $2.5 million.
After Moucka was arrested and indicted, screenshots circulating online appeared to show Kiberphant0m claiming on a dark web forum to be in possession of Trump’s and Harris’ call logs.
“In the event you do not reach out to us @ATNT all presidential government call logs will be leaked,” Kiberphant0m said. “You don’t think we don’t have plans in the event of an arrest? Think again.”
The case has been transferred to the U.S. District Court for the Western District of Washington in Seattle, according to Krebs on Security.
Riley Ceder is a reporter at Military Times, where he covers breaking news, criminal justice, investigations, and cyber. He previously worked as an investigative practicum student at The Washington Post, where he contributed to the Abused by the Badge investigation.
