ThreatPaper
Assessed, Not Confirmed

The leaked call records belonged to Trump and Harris

Assessment

The Justice Department's sentencing release deliberately did not name the officials whose stolen call detail records Wagenius posted, describing only 'a government official' and 'family members of another former official.' Reporting supplied the names the government withheld: CyberScoop reported that the records included those of President Donald Trump, tied to a failed $500,000 extortion attempt against AT&T, and earlier KrebsOnSecurity reporting associated the AT&T call logs with both then-President-elect Trump and Vice President Kamala Harris. The Trump identification rests on more reporting than the Harris one, and both are journalist-sourced: the indictment neither confirms nor denies the identities. A reader should treat 'Trump and Harris' as credibly reported rather than court-established.

Where this claim appeared

CyberScoop · 2026-09-26

https://cyberscoop.com/cameron-wagenius-att-snowflake-attacks-sentenced/

What “Assessed, Not Confirmed” means

A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.

4 of 5 · rating scale

Assessed in

Cameron Wagenius: the 'kiberphant0m' soldier gets 70 months for the Snowflake-linked telecom extortion spree

Think this assessment is wrong? Report an error.