campaign · 1711929600000

Snowflake Data Exfiltration Campaign

A threat actor compromised over 100 customer accounts of the Snowflake cloud data platform, leading to massive data exfiltration affecting major corporations like AT&T, Ticketmaster, and Santander Bank.

What happened

Threat actors associated with the Scattered Spider group used stolen credentials to access Snowflake customer accounts that lacked multi-factor authentication. They systematically exfiltrated large volumes of sensitive data from these accounts and attempted to extort the affected companies.

Technical mechanism

The attackers obtained legitimate credentials for Snowflake customer accounts, often via info-stealing malware. They then accessed these accounts, which were not protected by multi-factor authentication (MFA), and used native Snowflake tools to query and exfiltrate data.

Why it matters

This campaign exposed the vulnerability of cloud data platforms to credential-based attacks, resulting in the theft of billions of records and highlighting the critical need for robust identity management and multi-factor authentication across cloud environments.

Impact

Over 100 Snowflake customers were affected, including high-profile breaches at AT&T, Ticketmaster, and Santander Bank. Billions of customer records were stolen, and attackers demanded ransoms ranging from $300,000 to $5 million.

Response

Snowflake, along with cybersecurity firms like Mandiant, investigated the incident and confirmed that the platform itself was not breached, but rather individual customer accounts. Affected companies notified customers and regulatory bodies.

Defensive lessons

Enforce Multi-Factor Authentication (MFA) for all cloud platform access.
Implement network allowlisting to restrict access to trusted IP addresses.
Monitor for abnormal data access patterns and large-scale data exfiltration.

Evidence register

Cybersecurity and Infrastructure Security Agency (CISA) — Threat Actors Exploiting Snowflake Customer Environments (verified)