US Hacker Likely Linked to '24 BSNL Data Breach

Cameron John Wagenius, a Communications Specialist Stationed in South Korea, Was Arrested on December 20 for Attempting to Sell Hacked Data from American Telecom Firms

- Aditi Agrawal

NEW DELHI: An American soldier arrested in Texas last month for selling hacked telecom data is likely linked to a major data breach at India's State-owned BSNL last year, cybersecurity analysts and publicly available information suggest, bringing into the spotlight the cross-continental workings of an underground cybercrime industry.

Cameron John Wagenius, a communications specialist stationed in South Korea, was arrested on December 20 for attempting to sell hacked data from American telecom companies. Wagenius, according to a report by an American cybersecurity publication and experts HT spoke to, is likely "kiberphantom" on a popular dark web marketplace, where he also attempted to sell 278 GB of sensitive BSNL data in May for $5,000—a fraction of its potential value.

The stolen data included critical subscriber information and security infrastructure details, including international mobile subscriber identities, SIM numbers, and BSNL's home location register—a database containing user histories and call routing information. The hacker also claimed to have obtained snapshots of BSNL's SOLARIS server and security key data.

The arrest puts a rare name and face behind shadow criminal commodities market, where hackers break into networks and harvest sensitive data then pass it onto well-connected brokers like him who advertise their stolen goods on underground forums.

On May 29 last year, kiberphantom made the sale post on Breached Forums: "Information is worth several million dollars but I'm selling for pretty cheap. Negotiate a deal in telegram." The post directed potential buyers to a Telegram account under the handle @cyb3rph4nt0m, which was last active on December 7.