Résumé
In mid-2024, a single gap, accounts without multi-factor authentication, turned into one of the largest waves of data theft ever, hitting Ticketmaster, AT&T, Santander, and around 165 other companies at once. The attackers never broke Snowflake, the cloud data platform all of them used. They simply logged in with valid usernames and passwords, harvested months or years earlier by infostealer malware from employees' personal computers and bought on criminal markets. Where MFA was not turned on, a stolen password was a full key. It is the defining lesson of the infostealer era: your breach can start on an employee's home laptop, and MFA is the difference between a leaked password and a catastrophe.
How it happened
The threat group UNC5537 ran mass data theft against about 165 Snowflake customer tenants between roughly April and June 2024, and it is important to be precise about what they did not do: they did not exploit any flaw in Snowflake. The chain started elsewhere. Infostealer malware (families like Vidar, RedLine, and Lumma) on employee and contractor machines, often personal devices, and some infections years old, had quietly harvested saved Snowflake credentials, which were then sold and circulated on criminal markets. Mandiant found that at least 79.7% of the abused accounts had a prior infostealer exposure, with the earliest credential dating back to 2020.
The attackers just logged in. The targeted accounts had no MFA enabled and no network allow-listing, so a stolen single-factor credential granted direct access to the data warehouse. From there, using a custom reconnaissance tool Mandiant named FROSTBITE to enumerate each instance, they ran bulk exports of customer data and extorted the victims. Every step was a normal login; the only thing missing was a second factor.
The damage
The victim list was staggering: Ticketmaster and Live Nation (data on about 560 million customers), Santander (whose data the attackers advertised as 30 million customer records, though Santander itself confirmed only that a database including about 12,786 of its employees was affected), and AT&T (call and text metadata for roughly 110 million customers, with AT&T reportedly paying about $370,000), across around 165 tenants in total. The Ticketmaster access reportedly traced to infostealer credentials for a former Snowflake employee's demo account that had no MFA. Independent investigations by both Mandiant and CrowdStrike concluded the campaign stemmed entirely from stolen customer credentials, not any flaw in Snowflake. By late 2024 two suspects had been charged: Connor Moucka, arrested in Canada in October 2024, and John Binns, arrested in Turkey. It was one of the largest data-theft campaigns in history, and almost entirely preventable; the common thread across every victim was not a clever exploit but a missing checkbox.
Why Snowflake still matters
Snowflake is the infostealer-plus-missing-MFA lesson at scale. The corporate perimeter is irrelevant when the credential leaks from an employee's home PC, and the only thing standing between a stolen password and your entire data warehouse is MFA, which these accounts did not have. In the aftermath Snowflake moved hard on the gap: it made MFA the default for new accounts and announced it would block password-only sign-in entirely, where the second factor had previously been optional. The other defences are unglamorous: enforce MFA on every cloud account (especially admin and service accounts), restrict access with network allow-lists or private connectivity, replace static passwords with SSO and key-pair authentication, monitor for infostealer-harvested credentials and anomalous logins, and alert on large or unusual data exports. It is the same single-credential, no-MFA failure as the Colonial Pipeline attack.
Comment le corriger
- Enforce MFA on every account immediately, reset all credentials, and revoke active sessions, since the access was valid stolen logins.
- Add network allow-listing so the data platform is only reachable from known locations, and hunt for and quantify what data was exported.
- Identify infostealer-infected employee and contractor machines and rebuild them; the leaked credentials originate there.
Comment l’éviter
- Enforce MFA on every cloud data-platform account, especially admin and service accounts; never leave it optional.
- Restrict warehouse access with network policies/allowlists or private connectivity to known sources.
- Replace static user passwords with SSO and key-pair auth; rotate credentials immediately on exposure.
- Detect infostealer-harvested credentials and alert on logins from new locations, clients, or IPs.
- Apply least privilege to warehouse roles and alert on large or unusual data exports.
Références
- https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion
- https://krebsonsecurity.com/2024/11/canadian-man-arrested-in-snowflake-data-extortions/
- https://www.snowflake.com/en/blog/multi-factor-identification-default/
- https://www.bleepingcomputer.com/news/security/snowflake-account-hacks-linked-to-santander-ticketmaster-breaches/
Vulnérabilités liées
Tout OpSec →- CRITICALOPSEC-MIDNIGHT-BLIZZARD-2024
In January 2024, Microsoft revealed that Russia's foreign-intelligence service, the same APT29 behind SolarWinds, had been reading the email of its senior leadership. The way in was almost insulting in its simplicity: a forgotten, non-production test account with a weak password and no MFA. The attackers guessed the password by spraying common ones across many accounts, then pivoted through a forgotten over-privileged application to grant themselves access to corporate mailboxes, including those of executives and the security and legal teams. It is the lesson that your security is only as strong as the account you forgot about, and that even Microsoft's perimeter fell to a missing MFA checkbox.
- HIGHOPSEC-UBER-2022
In September 2022, an 18-year-old broke into Uber and posted screenshots of its internal systems to prove it, an embarrassingly total compromise that started with a tactic anyone can fall for: pestering. The attacker, part of the Lapsus$ group, had a contractor's stolen password, and to get past multi-factor authentication, simply spammed the contractor with login-approval prompts until, worn down and then nudged over WhatsApp by the attacker posing as IT, they tapped "approve." Once inside, the attacker found a script with a hardcoded admin password that unlocked Uber's most powerful systems at once. It is the textbook lesson in MFA fatigue, and in how one hardcoded secret turns a foothold into a takeover.
- CRITICALOPSEC-23ANDME-2023
23andMe held the most personal data there is: people's DNA. In 2023 attackers got into more than 18,000 accounts and, through a single social feature, turned that into the genetic and ancestry data of roughly 6.9 million people. The break-in required no flaw in 23andMe at all. Attackers simply took username-and-password pairs leaked from other companies' breaches and tried them, betting, correctly, that people reuse passwords. The accounts had no MFA, and 23andMe did not notice the five-month wave of automated logins. From those footholds, the attackers scraped relatives' data through an opt-in feature, and the fallout, fines, a $50 million settlement, and ultimately bankruptcy and a fire-sale of the DNA database itself, shows that a breach can be fatal even when your own systems were never hacked.
- CRITICALOPSEC-MGM-CAESARS-2023
In September 2023, two of the biggest names in Las Vegas, MGM Resorts and Caesars Entertainment, were brought to their knees, not by a sophisticated exploit, but by a phone call. The Scattered Spider group simply called the companies' IT help desks, impersonated employees, and talked the support staff into resetting their multi-factor authentication, handing the attackers a way in. From there they deployed ALPHV/BlackCat ransomware. Caesars paid about $15 million; MGM refused and took a roughly $100 million hit as slot machines, hotel keys, and check-in systems went dark for days. It is the lesson that the help desk is part of your attack surface, and that the most advanced MFA is undone by a human who can be convinced to reset it.
- CRITICALOPSEC-LASTPASS-2022
LastPass is a password manager, the digital vault tens of millions of people trusted with every password they have. In 2022 attackers got into it, and the breach unfolded in a way that turned a developer's home computer into a path to those vaults. A first intrusion stole source code. The attackers used it to identify and target one of only four engineers who held the keys to production backups, planting a keylogger on his home PC through an unpatched flaw in, of all things, his Plex media server. With his master password captured, they exfiltrated backups of customers' encrypted password vaults. The encryption held, but anyone with a weak master password was now exposed to offline cracking at the attacker's leisure. It is the lesson that a vault is only as strong as the master password protecting it, and that your blast radius includes your engineers' home machines.
- HIGHOPSEC-TWILIO-2022
On 7 August 2022, Twilio, a company whose entire business is sending text messages and verification codes for other companies, was breached through text messages. Attackers ran an SMS phishing campaign against Twilio's own employees, texting them fake "your password expired" alerts from numbers that looked like Twilio IT and linking to convincing fake login pages. Several staff entered their credentials, handing over access to internal tools and the data of more than 200 customers, and rippling downstream to users of the secure-messaging app Signal. It was one strike in a sprawling campaign, dubbed 0ktapus, that phished around 130 companies the same way. It is the lesson that phishing-resistant MFA exists for a reason: ordinary credentials and codes can always be talked out of a human.