2024Data breach
Snowflake customer data theft campaign
April to June 2024
Attackers logged in to Snowflake customer accounts with credentials stolen by infostealer malware on employee and contractor computers, then stole data and extorted the victims. Mandiant found no evidence of a breach of Snowflake's own enterprise environment; every incident it investigated traced back to compromised customer credentials.
- Victim
- Organisations using the Snowflake cloud data platform
- Sector
- Cross-sector
- Public attribution
- Mandiant tracks the financially motivated actor as UNC5537; this page makes no further attribution.
- Malware
- RedLine StealerLumma Stealer
Impact
Mandiant and Snowflake notified approximately 165 potentially exposed organisations.
Root cause
Accounts without multi-factor authentication or network allow lists, using credentials exposed by infostealers and in some cases not rotated for years (Mandiant).
Lessons learned: the controls it teaches
- Enforce MFA on every cloud data platform account, including service accounts where possible.
- Restrict access to known networks and rotate credentials regularly.
- Shared responsibility: the customer owns identity configuration in SaaS platforms.