Connor Moucka, a 26-year-old Canadian citizen, has pled guilty to hacking more than 165 companies, stealing billions of records, and extorting several companies and individuals. 

On Wednesday, the U.S. Justice Department announced the guilty plea in a press release. 

Moucka was accused of hacking cloud provider Snowflake, which allowed him and his co-conspirators to break into dozens of the company’s customers, including AT&T, LendingTree, and Ticketmaster. Moucka stole data from more than 100 million AT&T customers, including call and texting records, as well as banking information, drivers’ license numbers, and Social Security numbers from other breaches. 

Over the years, Moucka and his accomplices received more than $2.5 million in ransom payments. The hacker also received around $500,000 for selling victims’ data on hacking forums such as the notorious BreachForums. Victims of Moucka and his accomplices’ hacks suffered $9.5 million in losses, according to the DOJ. 

“Connor Moucka’s threats and re-extortion tactics were calculated and predatory, and his actions did real harm to his victims, be they companies targeted for theft and extortion or the millions of everyday people who are their customers,” said W. Mike Herrington, an FBI special agent who worked on the case.

Moucka, who was known online as Waifu and Judische, was arrested in Canada at the end of 2024, just months after the Snowflake breaches. 

At the time, Austin Larsen, a senior researcher at Google’s cybersecurity firm Mandiant who had been investigating the Snowflake hacks, said Moucka was “one of the most consequential” hackers of 2024. 

Moucka is scheduled to be sentenced on October 27, and faces decades in prison.

Four Android advertising software development kits (SDKs) can collect or transmit a device’s location by default once the host app has location permission, according to an August 2026 investigation by the Electronic Frontier Foundation (EFF). The finding leaves app teams responsible for data flows they may not have knowingly enabled.

Because Android treats an app and its embedded code as one permission holder, an ad library can inherit location access granted for another feature. A shipping build can therefore transmit coordinates even when its consent flow and Google Play Data safety listing say nothing about third-party location sharing.

Android permissions extend to embedded ad code

The EFF investigation identified BidMachine, InMobi, Verve’s HyBid, and Huawei’s Petal Ads as libraries whose public documentation describes location collection or sharing by default when the app already has permission.

Researchers also tested two apps containing BidMachine: QR Scanner, with more than 50 million downloads, and GPS Speedometer, with more than 10 million. Network captures showed both sending precise coordinates to a BidMachine domain. Neither app displayed a notice before transmission, and neither Data safety section disclosed third-party location sharing.

For the other three SDKs, findings came from documentation review and, in HyBid’s case, open-source code rather than equivalent live traffic tests. InMobi says its library automatically forwards available location signals and recommends leaving that behavior enabled because location-enriched impressions typically earn more revenue. HyBid describes tracking as enabled by default, while Petal Ads includes location in ad requests unless developers use a separate opt-out method.

Precise Android location can resolve a device to within about 160 feet and sometimes 10 feet. When included in real-time bidding requests, those coordinates may be broadcast to thousands of prospective advertisers and collected by data brokers that join auctions for the information rather than the ad space.

That inherited-permission problem extends beyond advertising. A third-party Android SDK vulnerability recently exposed host-app privileges, while research into SDKs in apps marketed to US military personnel found mismatches between privacy disclosures and observed data practices.

App teams need evidence from the shipping build

Google’s Android SDK safety guidance says developers are responsible for an SDK’s data collection, including functions they do not use. Third-party location sharing must also appear in the Data safety form and comply with prominent disclosure and consent requirements.

In a 2024 order against InMarket, the Federal Trade Commission alleged that the company failed to ensure third-party apps using its location SDK had obtained informed consent before location data supported targeted advertising.

Contracts and developer documentation cannot prove what a production build transmits. Before each release, teams should:

• Inventory every advertising SDK and version.
• Remove precise location permission when it is not essential.
• Confirm each vendor’s location settings and opt-out behavior in code.
• Capture network traffic with location enabled and disabled.
• Inspect ad requests for coordinates, Wi-Fi identifiers, and persistent device IDs.
• Reconcile observed traffic with consent screens, privacy notices, and Data safety disclosures.

Google Play’s expanded app screening does not replace those checks. SDK behavior can change with an update, so traffic capture and disclosure review should remain recurring release controls rather than one-time integration tasks.

Also read: T-Mobile’s expanded T-Life privacy controls require separate checks across app, account, and device settings.

TikTok is laying off 250 employees and closing its Nashville office, which housed some members of TikTok’s content moderation team. The news was first reported by The New York Times.

Zanna Crowley, a spokesperson for the TikTok USDS Joint Venture, confirmed the news, saying that the shuttering was to “streamline our operations and better align our teams for long-term growth.”

“We remain fully committed to providing secure, safe and positive experiences for the 200 million Americans that create, discover and connect with what they love on TikTok,” the spokesperson said.

The cuts come as social media companies rely more on AI to monitor and remove violent or explicit content on their platforms.

The Nashville office, which TikTok leased in 2024, will close on October 5.