The Snowflake breaches: 165 organisations exposed by old stolen passwords

In 2024, attackers accessed the data of companies such as Ticketmaster and Santander stored on Snowflake, a cloud platform. Snowflake itself was not hacked: the attackers used stolen logins on accounts without two-factor authentication.

In spring 2024, a criminal group put data from Ticketmaster and Santander up for sale, saying it came from Snowflake, a cloud data platform used by thousands of companies. The investigation, led by Mandiant and Snowflake, told a simpler story.

What happened

• The group, tracked as UNC5537, used real usernames and passwords stolen from customers’ employees.
• Those credentials had been collected by infostealer malware on computers outside Snowflake, some infections dating back to 2020.
• About 165 organisations were notified as potentially affected, including Ticketmaster, Santander, Advance Auto Parts and the Los Angeles school district.
• According to the investigators, Snowflake’s own platform was not breached.

Three avoidable weaknesses

• The affected accounts had no two-factor authentication.
• Passwords stolen years earlier had never been changed.
• Access was not restricted to trusted networks or locations.

Why it concerns every business

The same pattern applies to an email account, a hosting panel or a website admin. A password stolen from a personal computer can open a business account years later if nothing else protects it.

What to do

• Turn on two-factor authentication on every cloud service, starting with those that hold customer data.
• Change passwords regularly on critical accounts, and immediately after a suspected infection.
• Restrict admin access by location or network when the service allows it.
• Remove accounts of people who no longer work with you.

An old stolen password is still a valid key until you change the lock.

Sources: Mandiant, Dark Reading, Cybersecurity Dive, June 2024.

Want your website admin protected by two-factor authentication? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.