The Snowflake Data Thefts: When No Vulnerability Was Needed

Between roughly April and June 2024, a financially motivated actor logged into many organisations’ Snowflake cloud data-warehouse tenants using valid credentials and bulk-exfiltrated data, then extorted victims and sold data on criminal forums. Crucially, this was not a breach of Snowflake’s own infrastructure: Mandiant and Snowflake’s joint investigation found every traced incident stemmed from compromised customer credentials — largely harvested by commodity infostealer malware, some infections years old — used against accounts that lacked multi-factor authentication and network allow-listing. It is the archetypal “no vulnerability needed” cloud identity breach.

No CVE — an Identity Failure

There is no CVE for this campaign. The failure was customer-side authentication hygiene, not a product flaw: credentials stolen by infostealers were replayed against SaaS tenants without MFA. T1078 T1555 T1530 T1567

Timeline

• 2020–2024: infostealer infections harvest credentials later reused.
• April 2024: Mandiant first observes the activity; late May 2024: Snowflake, Mandiant and CrowdStrike issue joint statements, with ~165 potentially exposed organisations notified.
• May–July 2024: victim disclosures (Ticketmaster/Live Nation, Santander, AT&T and others).
• October 2024: Alexander “Connor” Moucka arrested in Kitchener, Ontario on a U.S. warrant; a second suspect had been arrested in Turkey. DOJ later unsealed charges.

Attribution & Impact

Mandiant tracks the actor as UNC5537, financially motivated with members assessed in North America and Turkey; individual names derive from law-enforcement filings and journalism. Reported impact (attributed to disclosures): Ticketmaster data (~560 million records offered for sale — a claim, not verified); AT&T’s disclosure of stolen call and text metadata for “nearly all” its cellular customers; and a Santander third-party-database compromise. T1657

Defensive Lessons

• Enforce MFA on all SaaS and cloud-warehouse accounts, including service and legacy accounts — the single highest-impact control here — and apply network allow-listing to known egress ranges.
• Treat any credential ever exposed to an infostealer as compromised; rotate, and monitor stealer-log marketplaces for your domains.
• Alert on anomalous bulk queries/exports and logins from new ASNs or geographies; baseline egress.
• Own the shared-responsibility boundary: the provider secures the platform; the customer secures identity, access and data. Minimise and expire sensitive data in warehouses.