Mandiant: Snowflake customer accounts hit by a wave of data theft

2024-06-10 · Publisher : Mandiant (Google Cloud) · Domain : Cloud & DevOps

Mandiant describes the UNC5537 campaign: about 165 organizations potentially exposed after theft of Snowflake customers' credentials, without any compromise of Snowflake's infrastructure. Without MFA, stolen logins were enough.

### Background On 10 June 2024 (updated 17 June), Mandiant, a Google Cloud company, published its analysis of the **UNC5537** campaign, run by a financially motivated actor. It stole large volumes of records from customer environments of the **Snowflake** data warehouse, then tried to resell them or demand ransom. Mandiant states that all intrusions trace back to stolen customer credentials, not to a flaw in Snowflake's infrastructure. ### Key facts - About 165 organizations were notified of potential exposure. - Credentials came from information-stealing malware (Vidar, RisePro, RedLine, Raccoon, Lumma, MetaStealer). Mandiant notes that 79.7% of the accounts used had previously had credentials exposed. - Three common factors: no multi-factor authentication, passwords never rotated (some valid since November 2020) and no allow-list of IP addresses. - Recommendations: enable MFA everywhere, rotate credentials, restrict access to trusted network addresses, monitor contractor access. ### Why it matters The case illustrates shared responsibility in the cloud: the platform was not hacked, but its customers' accounts were. For IT leaders and services firms administering data platforms for clients, the lesson is operational: mandatory MFA, secret rotation, network filtering and an inventory of the contractor machines that connect. ### Takeaway Stolen credentials without a second factor were enough to open entire data environments.

Tags : Sécurité, Incident, Données, Cloud