Snowflake customer campaign (2024)
A 2024 data theft campaign against some 165 customers of a cloud data platform, carried out with credentials stolen by infostealers, on accounts without multi-factor authentication; the platform itself had not been hacked.
Snowflake is a cloud data storage and analytics platform used by large companies. In spring 2024, a criminal group logged into the environments of about 165 of its customers with valid credentials, sometimes stolen years earlier by information-stealing malware on employees' or contractors' computers. These accounts were not protected by multi-factor authentication, then optional. The attackers exfiltrated massive volumes of data, including call records for nearly all customers of a large US telecom carrier, and customer data from ticketing firms, banks and retailers, then demanded ransoms under threat of publication. The investigation established that the platform had not been compromised: it was the customers, through their credentials, who had been. The case is a lesson on the shared responsibility model of cloud computing: the provider secures the infrastructure, the customer secures its access. For insurance, it showed that a single campaign can hit dozens of insureds at once without any flaw at the common provider, creating accumulation through the attack method rather than the technology. It also sped up the requirement for multi-factor authentication on all accounts, including those of contractors and analytics tools.
On June 10, 2024, Mandiant attributed the campaign to a group it tracks as UNC5537 and found that 79.7 percent of the accounts used had previously been exposed by infostealer malware, some as early as 2020. On July 12, 2024, AT&T disclosed that call and text records of nearly all its wireless customers, about 110 million people, had been copied from its Snowflake workspace.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.