A rapid and coordinated campaign has turned a cloud convenience into a cascading exposure. Attackers did not break Snowflake itself. They logged into customers’ Snowflake instances using credentials harvested long ago by infostealer malware. The result is widespread data theft, extortion attempts, and a stark reminder: third-party cloud services amplify weak practices at scale.

Mandiant’s investigation attributes the campaign to a financially motivated cluster tracked as UNC5537. Mandiant and Snowflake have informed roughly 165 potentially impacted customers that their environments may have been accessed and data exfiltrated. That number matters because it shows this was not a one-off compromise. It is a systematic exploitation of credential reuse and weak account protections.

Operational profile of the adversary is straightforward and effective. Actors obtained credentials from historical infostealer infections, then used those credentials to authenticate to customer-specific Snowflake endpoints that were not protected by multi-factor authentication. Where MFA was absent and network allow lists were not enforced, the attackers could pivot to download large data sets and post samples or auction the files on criminal forums. The technique is low cost and high yield.

Public reporting and forum postings indicate major downstream impact. Ticketmaster and Santander acknowledged incidents linked to data stored in third-party Snowflake accounts, and threat actors claimed troves of records from other large customers. Those claims remain under investigation in many cases, but their existence changed the threat calculus overnight: a single platform can become a force multiplier for a wide set of breaches when basic access controls fail.

This campaign is a textbook supply-chain amplification. Snowflake is a data warehouse utility used by thousands of enterprises. When credentials for user accounts, developer consoles, or vendor-managed integrations are exposed, attackers can treat the cloud provider as a long runway for exfiltration rather than an impregnable castle. The vulnerability was not a zero-day in Snowflake. It was predictable credential theft plus inconsistent security hygiene across customer environments.

What organizations must do now

1) Enforce MFA immediately. Accounts without multi-factor authentication were the path of least resistance. If you have any Snowflake accounts or similar managed data platforms, require MFA and pivot to stronger authentication mechanisms such as hardware or phishing-resistant tokens. Default to required MFA, do not merely recommend it.

2) Rotate and treat credentials as contaminated. Assume any credentials that were not protected by MFA and that were exposed in prior infostealer dumps are compromised. Reset passwords, roll service credentials, and revoke stale keys. Apply automated credential rotation for service accounts where possible.

3) Apply network allow lists and enforce least privilege. Limit administrative and data access to vetted IP ranges and identity contexts. Apply role-based access control and scope queries and storage to the minimum necessary. Do not let long-lived credentials provide unlimited lateral movement inside cloud tenants.

4) Hunt and log aggressively. Configure Snowflake and surrounding infrastructure to retain query and access logs, enable alerting on large exports, and run the detection queries and guidance provided by incident responders. If you cannot retain long enough for meaningful hunting, you cannot respond. Invest in log retention and active threat hunting.

5) Test the vendor model. Customers and the platform provider should clearly delineate who controls which credentials, who enforces MFA, and what service accounts third parties can create. Assume vendors can be a vector. Require vendors to demonstrate hygiene, rotate their credentials, and publish attestations periodically.

Strategic takeaways for boards and CISOs

This incident elevates two enduring truths. First, scale changes risk geometry. A weak link in credential hygiene across many customers converts a single commodity product into a multi-tenant breach amplifier. Second, visibility and enforcement are the only durable mitigations. Platform-level sentiment that “we did not get breached” is not a defense if thousands of customer accounts are poorly protected.

Board-level actions should include mandatory enforcement of MFA and conditional access controls for any critical cloud service, a push for centralized credential management and rotation, and investment in logging and threat-hunting capabilities that cover third-party-hosted datasets. Expect regulators and customers to demand tighter controls and clearer vendor accountability after this.

Final point: this is not the last time. Infostealers have matured and remain widely available. Attackers will continue to weaponize stolen credentials against cloud-hosted data stores because the economics are favorable. Until the industry treats credentials and access as the new perimeter and enforces phishing-resistant authentication and network segmentation by default, these supply-chain style incidents will recur. Do the simple, necessary things now. They will stop most of the noise and slow down the adversary long enough to detect and contain more sophisticated follow-ons.