US hacker likely linked to '24 BSNL data breach

CAMERON JOHN WAGENIUS, A COMMUNICATIONS SPECIALIST STATIONED IN SOUTH KOREA, WAS ARRESTED ON DECEMBER 20 FOR ATTEMPTING TO SELL HACKED DATA FROM AMERICAN TELECOM FIRMS

- Aditi Agrawal

NEW DELHI: An American soldier arrested in Texas last month for selling hacked telecom data is likely linked to a major data breach at India's State-owned BSNL last year, cybersecurity analysts and publicly available information suggest, bringing into the spotlight the cross-continental workings of an underground cybercrime industry.

Cameron John Wagenius, a communications specialist stationed in South Korea, was arrested on December 20 for attempting to sell hacked data from American telecom companies. Wagenius, according to a report by an American cybersecurity publication and experts HT spoke to, is likely "kiberphantom" on a popular dark web marketplace, where he also attempted to sell 278 GB of sensitive BSNL data in May for $5,000 – a fraction of its potential value.

The stolen data included critical subscriber information and security infrastructure details, including international mobile subscriber identities, SIM numbers, and BSNL's home location register – a database containing user histories and call routing information. The hacker also claimed to have obtained snapshots of BSNL's SOLARIS server and security key data.

The arrest puts a rare name and face behind shadow criminal commodities market, where hackers break into networks and harvest sensitive data then pass it onto well-connected brokers like him who advertise their stolen goods on underground forums.

On May 29 last year, kiberphantom made the sale post on Breached Forums: "Information is worth several million dollars but I'm selling for pretty cheap. Negotiate a deal in telegram". The post directed potential buyers to a Telegram account under the handle @cyb3rph4nt0m, which was last active on December 7.