Snowflake Credential Theft: Ticketmaster, AT&T, and 160 Others Breached via Stolen Logins
A hacking group used infostealer malware logs to collect Snowflake login credentials from data engineers' laptops, then accessed customer databases directly — no hacking required, just valid usernames and passwords.
Attack Chain
- 1Infostealer malware infects contractor
- 2Credentials stolen (no MFA)
- 3Snowflake accounts accessed
- 4160+ customer databases exfiltrated
- 5Ticketmaster, AT&T data listed for sale
Background
Snowflake is a cloud data warehousing platform used by thousands of major corporations to store and query large datasets. Many customers stored highly sensitive data — customer records, call logs, payment data — in Snowflake, relying on Snowflake's own security rather than implementing additional controls.
The Attack
The attackers — a group called ShinyHunters and an associate known as Judische — purchased logs from infostealer malware that had infected data engineers' personal laptops. These logs contained the Snowflake credentials stored in browser profiles and credential managers. Because most Snowflake tenants had not enabled MFA, the valid credentials provided direct database access. Using a custom tool called "RapeFlake," they systematically connected to Snowflake instances and exfiltrated data. Victims included Ticketmaster (560 million records), AT&T (110 million customers' call records), Advance Auto Parts, and at least 160 other organisations.
Response
Snowflake issued guidance urging all customers to enable MFA and review connected third-party application access. The platform itself was not breached — the attackers used legitimate credentials. AT&T paid $370,000 to the attacker to delete its data. Two suspects were arrested, including one while attempting to enter Canada.
Outcome
The case illustrated that cloud platform breaches increasingly happen through compromised credentials, not platform vulnerabilities. Snowflake subsequently made MFA mandatory for all new accounts. The scale — 160+ organisations breached simultaneously — demonstrated the leverage available to attackers who can harvest credentials at scale.
Key Takeaways
- Enforce MFA on all cloud data platform accounts — no exceptions for legacy or service accounts
- Infostealer malware on developer laptops is a direct path to corporate cloud environments
- Cloud tenants cannot rely solely on platform security — implement your own access controls and MFA
- Credential hygiene across personal and corporate devices matters — browser-stored passwords are vulnerable