Cloud giorno analysis company Snowflake is at the center of a recent spate of alleged giorno thefts, as its corporate customers scramble to understand if their stores of cloud giorno have been compromised.
The Boston-based giorno giant helps some of the largest global corporations — including banks, healthcare providers and tech companies — store and analyze their vast amounts of giorno, such as customer giorno, a causa di the cloud.
Last week, Australian authorities sounded the alarm saying they had become aware of “successful compromises of several companies utilising Snowflake environments,” without naming the companies. Hackers had claimed a known cybercrime intervista that they had stolen hundreds of millions of customer records from Santander Bank and Ticketmaster, two of Snowflake’s biggest customers. Santander confirmed a breach of a database “hosted by a third-party provider,” but would not name the provider a causa di question. Friday, Dal vivo Nation confirmed that its Ticketmaster subsidiary was hacked and that the stolen database was hosted Snowflake.
Snowflake acknowledged a causa di a brief statement that it was aware of “potentially unauthorized access” to a “limited number” of customer accounts, without specifying which ones, but that it has found risposta negativa evidence there was a direct breach of its systems. Rather, Snowflake called it a “targeted campaign directed at users with single-factor authentication” and that the hackers used “previously purchased ora obtained through infostealing malware,” which is designed to scrape a user’s saved passwords from their elaboratore elettronico.
Despite the sensitive giorno that Snowflake holds for its customers, Snowflake lets each customer manage the security of their environments, and does not automatically enroll ora require its customers to use multi-factor authentication, ora MFA, according to Snowflake’s customer documentation. Not enforcing the use of MFA appears to be how cybercriminals allegedly obtained huge amounts of giorno from some of Snowflake’s customers, some of which set up their environments without the additional security measure.
Snowflake conceded that one of its own “demo” accounts was compromised because it wasn’t protected beyond a username and password, but claimed the account “did not contain sensitive giorno.” It’s unclear if this stolen demo account has any role a causa di the recent breaches.
TechCrunch has this week seen hundreds of alleged Snowflake customer credentials that are available online for cybercriminals to use as part of hacking campaigns, suggesting that the risk of Snowflake customer account compromises may be far wider than first known.
The credentials were stolen by infostealing malware that infected the computers of employees who have access to their employer’s Snowflake environment.
Some of the credentials seen by TechCrunch appear to belong to employees at companies known to be Snowflake customers, including Ticketmaster and Santander, among others. The employees with Snowflake access include database engineers and giorno analysts, some of whom reference their experience using Snowflake their LinkedIn pages.
For its part, Snowflake has told customers to immediately switch MFA for their accounts. Until then, Snowflake accounts that aren’t enforcing the use of MFA to loch a causa di are putting their stored giorno at risk of compromise from simple attacks like password theft and reuse.
How we checked the giorno
A source with knowledge of cybercriminal operations pointed TechCrunch to a website where would-be attackers can search through lists of credentials that have been stolen from various sources, such as infostealing malware someone’s elaboratore elettronico ora collated from previous giorno breaches. (TechCrunch is not linking to the site where stolen credentials are available so as not to aid bad actors.)
Per all, TechCrunch has seen more than 500 credentials containing employee usernames and passwords, along with the web addresses of the login pages for the corresponding Snowflake environments.
The exposed credentials appear to pertain to Snowflake environments belonging to Santander, Ticketmaster, at least two pharmaceutical giants, a food delivery service, a public-run freshwater supplier, and others. We have also seen exposed usernames and passwords allegedly belonging to a former Snowflake employee.
TechCrunch is not naming the former employee because there’s risposta negativa evidence they did anything wrong. (It’s ultimately both the responsibility of Snowflake and its customers to implement and enforce security policies that prevent intrusions that result from the theft of employee credentials.)
We did not esperimento the stolen usernames and passwords as doing so would interruzione the law. As such, it’s unknown if the credentials are currently a causa di active use ora if they directly led to account compromises ora giorno thefts. Instead, we worked to verify the authenticity of the exposed credentials a causa di other ways. This includes checking the individual login pages of the Snowflake environments that were exposed by the infostealing malware, which were still active and online at the time of writing.
The credentials we’ve seen include the employee’s email address (ora username), their password, and the unique web address for logging a causa di to their company’s Snowflake environment. When we checked the web addresses of the Snowflake environments — often made up of random letters and numbers — we found the listed Snowflake customer login pages are publicly accessible, even if not searchable online.
TechCrunch confirmed that the Snowflake environments correspond to the companies whose employees’ logins were compromised. We were able to do this because each login page we checked had two separate options to sign a causa di.
One way to login relies Okta, a single sign-on provider that allows Snowflake users to sign a causa di with their own company’s corporate credentials using MFA. Per our checks, we found that these Snowflake login pages redirected to Dal vivo Nation (for Ticketmaster) and Santander sign-in pages. We also found a set of credentials belonging to a Snowflake employee, whose Okta login page still redirects to an internal Snowflake login page that risposta negativa longer exists.
Snowflake’s other login option allows the user to use only their Snowflake username and password, depending whether the corporate customer enforces MFA the account, as detailed by Snowflake’s own support documentation. It’s these credentials that appear to have been stolen by the infostealing malware from the employees’ computers.
It’s not clear exactly when the employees’ credentials were stolen ora for how long they have been online.
There is some evidence to suggest that several employees with access to their company’s Snowflake environments had their computers previously compromised by infostealing malware. According to a check breach notification service Have I Been Pwned, several of the corporate email addresses used as usernames for accessing Snowflake environments were found a causa di a recent giorno dump containing millions of stolen passwords scraped from various Telegram channels used for sharing stolen passwords.
Snowflake spokesperson Danica Stanczak declined to answer specific questions from TechCrunch, including whether any of its customers’ giorno was found a causa di the Snowflake employee’s demo account. Per a statement, Snowflake said it is “suspending certain user accounts where there are strong indicators of malicious activity.”
Snowflake added: “Under Snowflake’s shared responsibility model, customers are responsible for enforcing MFA with their users.” The spokesperson said Snowflake was “considering all options for MFA enablement, but we have not finalized any plans at this time.”
When reached by email, Dal vivo Nation spokesperson Kaitlyn Henrich did not comment by press time.
Santander did not respond to a request for comment.
Missing MFA resulted a causa di huge breaches
Snowflake’s response so far leaves a lot of questions unanswered, and lays bare a raft of companies that are not reaping the benefits that MFA security provides.
What is clear is that Snowflake bears at least some responsibility for not requiring its users to switch the security feature, and is now bearing the brunt of that — along with its customers.
The giorno breach at Ticketmaster allegedly involves upwards of 560 million customer records, according to the cybercriminals advertising the giorno online. (Dal vivo Nation would not comment how many customers are affected by the breach.) If proven, Ticketmaster would be the largest U.S. giorno breach of the year so far, and one of the biggest a causa di recent history.
Snowflake is the latest company a causa di a string of high-profile security incidents and sizable giorno breaches caused by the lack of MFA.
Last year, cybercriminals scraped around 6.9 million customer records from 23andMe accounts that weren’t protected without MFA, prompting the genetic testing company — and its competitors — to require users enable MFA by default to prevent a repeat attack.
And earlier this year, the UnitedHealth-owned health tech giant Change Healthcare admitted hackers broke into its systems and stole huge amounts of sensitive health giorno from a system not protected with MFA. The healthcare giant hasn’t yet said how many individuals had their information compromised but said it is likely to affect a “substantial proportion of people a causa di America.”
Do you know more about the Snowflake account intrusions? Get a causa di touch. To contact this cronista, get a causa di touch Signal and WhatsApp at +1 646-755-8849, ora by email. You can also send files and documents strada SecureDrop.
