Quick answer: In 2024, a financially motivated group tracked by Mandiant as UNC5537 used passwords stolen by infostealer malware to log in to the Snowflake cloud data accounts of about 165 organizations. The accounts did not use multifactor authentication. Victims included Ticketmaster and AT&T. Snowflake said its own platform was not breached: the attackers simply logged in with valid stolen credentials.
| Key facts | |
|---|---|
| Date | April to June 2024 (disclosed from late May 2024) |
| Organizations | About 165 Snowflake customers, including Ticketmaster and AT&T |
| Type of attack | Credential-based data theft and extortion |
| Attacker | UNC5537 (tracked by Mandiant); data advertised by ShinyHunters |
| How they got in | Passwords stolen by infostealer malware, some dating back to 2020, on accounts without MFA |
| Impact | Large volumes of customer data stolen and offered for sale or used for extortion |
Timeline
- April 2024: Attackers begin logging in to Snowflake customer accounts with stolen credentials.
- 28 May 2024: ShinyHunters advertises data said to belong to 560 million Ticketmaster users.
- 31 May 2024: Live Nation, Ticketmaster’s parent, confirms the breach in a filing with the SEC.
- 10 June 2024: Mandiant publishes its investigation into UNC5537.
- 12 July 2024: AT&T announces that call and text records stored in Snowflake were accessed.
What happened
Snowflake is a cloud data platform that many large companies use to store and analyze data. In spring 2024, a group Mandiant calls UNC5537 logged in to customer accounts using usernames and passwords that had been stolen by infostealer malware on employees’ and contractors’ computers. Some of the credentials dated back to infections in 2020 and had never been changed.
A joint investigation by Snowflake, Mandiant and CrowdStrike found that about 165 organizations were targeted. The common factor was that the accounts did not require multifactor authentication.
Ticketmaster and AT&T
On 28 May 2024, the ShinyHunters group advertised data it said came from 560 million Ticketmaster users. Live Nation confirmed the breach in an SEC filing on 31 May. On 12 July 2024, AT&T announced that about six months of customer call and text records stored in Snowflake had been accessed.
Whose fault was it?
Snowflake’s position was that its own systems were not breached. The attackers used valid customer credentials. Critics and US senators argued the platform should have required MFA by default. The lesson applies to every cloud service: security settings left to the customer are often left off.
Lessons for your organization
- Enforce MFA on every cloud platform, especially data warehouses and admin consoles.
- Rotate old credentials and remove accounts that are no longer needed.
- Restrict cloud data access to known networks or devices where possible.
- Protect employee and contractor devices from infostealer malware with endpoint protection.
- Ask cloud providers which security controls are on by default and which you must turn on.
This incident is part of our guide to major cyber attacks and data breaches, which compares the biggest incidents and the patterns behind them. See our comparison of the best CSPM tools for finding cloud misconfigurations. To see whether the same weaknesses exist in your organization, take the free Cybersecurity Readiness Assessment.
Frequently asked questions
Was Snowflake hacked?
Snowflake said its own platform was not breached. Attackers logged in to customer accounts using stolen passwords on accounts without multifactor authentication.
Which companies were affected by the Snowflake breach?
About 165 organizations were targeted, including Ticketmaster and AT&T.
How could the Snowflake breach have been prevented?
Multifactor authentication, rotating old passwords and limiting access to known networks would have blocked most of the logins.
