Snowflake Class Action Lawsuit: Data Breach and Securities Fraud

The Snowflake class action lawsuit landscape has two distinct tracks. Investors sued the cloud data company and its top executives in early 2024 for allegedly misleading the market about customer demand, and consumers whose personal information was stolen in a 2024 breach of Snowflake customer accounts sued in a multidistrict litigation that has already produced several settlements. Both matters remain active in 2026.

The Data Breach Litigation

Between April and June 2024, attackers stole data belonging to more than 160 corporate customers stored on the Snowflake cloud platform. The personal information of over 500 million consumers and employees was taken.{¹

The federal lawsuits that followed were consolidated into In re: Snowflake, Inc., Data Security Breach Litigation, MDL No. 3126, before Judge Brian Morris in the District of Montana.{²

The attackers, tracked by researchers as UNC5537, used stolen login credentials, many of them harvested by infostealer malware, to get into customer accounts that were not protected by multi-factor authentication. Snowflake did not require MFA at the time and left enrollment to individual users.{ Snowflake has maintained that its platform itself was not breached and that the incidents were “identity-based attacks” using credentials exposed through unrelated activity.{³

Companies Whose Customer Data Was Exposed

The breach touched some of the largest consumer-facing businesses in the country:

AT&T: call and text metadata for roughly 110 million customers.{⁴
Ticketmaster/Live Nation: data on approximately 560 million individuals, including names, addresses, and partial payment card information.{⁴
Advance Auto Parts: approximately 2.3 million individuals.{⁵
Neiman Marcus: over 31 million email addresses, plus names, dates of birth, gift card information, and partial credit card and Social Security numbers.{{⁶⁷
Santander Bank, Pure Storage, Cricket Wireless, and Lending Tree’s QuoteWizard subsidiary were also named as victims.{¹

Settlements and What You Can Claim

Several defendant companies have settled with affected consumers. Snowflake itself has been dismissed from two of these tracks.

Advance Auto Parts — $10 Million

The court granted final approval on October 23, 2025. The class covers roughly 2.3 million people whose personal information was compromised. The settlement pays cash for documented losses and required Advance Auto Parts to change its data security practices. Class counsel received approximately $3.3 million in fees, and each of the six class representatives was awarded $2,500.{⁸ Claims against Snowflake itself by the Advance Auto Parts plaintiffs were dismissed with prejudice on December 19, 2025.{¹

Neiman Marcus — $3.5 Million

Preliminary approval came on May 22, 2025. Eligible class members could claim up to $2,500 for documented losses and were entitled to two years of credit monitoring. The claim deadline was October 8, 2025, and the final approval hearing took place on October 23, 2025.{⁷{⁹ Neiman Marcus did not admit wrongdoing. Snowflake was dismissed from this track with prejudice on December 19, 2025.{¹

AT&T — $177 Million (Two Breaches)

The AT&T litigation was moved out of the Montana MDL to a separate consolidated proceeding in the Northern District of Texas before Judge Ada Brown. The $177 million settlement covers two 2024 breaches, with $28 million allocated specifically to the Snowflake-linked incident from July 2024. Affected customers could claim up to $2,500 for documented losses. The claim deadline was December 18, 2025, and roughly 4.38 million claims had been submitted across both breach categories by early 2026. A final approval hearing was held on January 15, 2026; the court had not issued a decision as of mid-2026.{¹⁰{¹¹

Ticketmaster/Live Nation — No Settlement Yet

Claims against Ticketmaster and Live Nation remain active inside the Montana MDL. The companies have filed motions to dismiss, and the case is in discovery. No settlement has been announced.{¹

The Securities Fraud Case

On February 29, 2024, investors filed a securities fraud class action against Snowflake and two executives in the Northern District of California. The case, Flannery v. Snowflake Inc. (No. 24-cv-01234), alleges violations of the Securities Exchange Act of 1934.{¹² The individual defendants are former CEO and Chairman Frank Slootman and CFO Michael P. Scarpelli.{¹³

The complaint alleges Snowflake oversold consumption credits to customers, painting an artificial picture of demand. According to plaintiffs, steep pre-IPO discounts inflated early sales but were unsustainable once the company went public. When Snowflake later tuned its platform for efficiency, customer consumption dropped, hurting revenue and margins. Many customers were left sitting on large balances of unused credits and were positioned to roll them over or decline to renew at earlier levels.{¹²

The complaint also alleges executives publicly attributed reduced consumption to “platform enhancements” to mask the fallout from the earlier pricing tactics, and that Slootman and Scarpelli sold over $1 billion in Snowflake stock during the class period at prices as high as $400 per share.{¹³ A related set of allegations covers a later class period from June 27, 2023 through February 28, 2024, and focuses on undisclosed expected revenue drag from product efficiency improvements, Iceberg Tables, and tiered storage pricing, along with denials of rumors about Slootman’s departure while his resignation was already in motion.{¹⁴

The suit followed an 18% drop in Snowflake’s stock on February 29, 2024, after the company announced Slootman’s retirement and weaker-than-expected first-quarter guidance.{¹⁵

Judge P. Casey Pitts is presiding. The lead plaintiff filed a second amended complaint in April 2025, and the case remained ongoing as of June 2025.{¹⁶

Criminal Cases Against the Hackers

Federal prosecutors have charged three individuals tied to the breach. Prosecutors allege the group extorted approximately $2.5 million in bitcoin from at least three victim organizations.{¹⁷

Connor Riley Moucka, 25, of Kitchener, Ontario, was arrested in Canada on October 30, 2024,{¹⁸ agreed to extradition, and pleaded not guilty in the Western District of Washington on July 3, 2025 to 20 charges including wire fraud, computer fraud and abuse, extortion, and aggravated identity theft. His trial is set for October 19, 2026.{¹⁹{²⁰

John Erin Binns, Moucka’s alleged co-conspirator, was arrested in Turkey in late May 2024 and had previously been indicted in the U.S. for a 2021 T-Mobile breach. He has reportedly been granted Turkish citizenship, and a senior Turkish official said he will not be extradited.{¹⁸{²¹

Cameron John Wagenius, a 21-year-old former U.S. Army soldier who used the alias “kiberphant0m,” pleaded guilty on July 15, 2025 to conspiracy to commit wire fraud, extortion in relation to computer fraud, and aggravated identity theft, along with two counts of unlawfully transferring confidential phone records. He faces a maximum of 27 years and was scheduled for sentencing on October 6, 2025.{²²{²³

1
U.S. District Court for the District of Montana. Snowflake Data Security Breach Litigation
2
CourtListener. In Re: Snowflake Inc. Data Security Breach Litigation
3
Cybersecurity Dive. Snowflake MFA Policy Change
4
Huntress. Snowflake Data Breach
5
ClassAction.org. In Re: Snowflake Inc. Data Security Breach Litigation Preliminary Approval Order
6
CRN. Data Theft Impacts From Snowflake Attacks Continue to Expand
7
NMG Settlement. Neiman Marcus Group Data Breach Settlement
8
U.S. District Court for the District of Montana. Order Granting Class Action Settlement, Advance Auto Parts
9
ClassAction.org. In Re: Snowflake Inc. Data Security Breach Litigation, Neiman Marcus Settlement Agreement
10
Telecom Data Settlement. In Re AT&T Inc. Customer Data Security Breach Litigation
11
New Haven Register. AT&T Data Breach Settlement Attorney Fees
12
Business Wire. SNOW Investor Notice
13
Robbins Geller Rudman & Dowd LLP. Flannery v. Snowflake Inc. Complaint
14
Morningstar. Bronstein Gewirtz Grossman LLC Urges Snowflake Inc. Investors to Act
15
CNBC. Snowflake Shares Drop on CEO’s Retirement, Weak Guidance
16
Stanford Securities Class Action Clearinghouse. Snowflake Inc. Securities Litigation
17
Bitdefender. Snowflake Hacker Extradited to US
18
KrebsOnSecurity. Canadian Man Arrested in Snowflake Data Extortions
19
U.S. Department of Justice. United States vs. Connor Riley Moucka and John Erin Binns
20
CourtListener. United States v. Moucka
21
Fortune. Unlikely Trio Linked to Hack of AT&T Data
22
U.S. Department of Justice. Former U.S. Soldier Pleads Guilty to Hacking and Extortion Scheme
23
CyberScoop. Cameron Wagenius AT&T Snowflake Guilty Plea