Sekoia says the Snowflake thefts that hit at least 165 organizations in 2024 came from bought credentials, not a Snowflake flaw. The company ties the access to UNC5537 and the follow-on ShinyHunters extortion, and says some of the stolen logins had been scraped by infostealer malware as far back as 2020.
The pattern is simple: attackers buy credentials that infostealers already pulled from personal or contractor devices, then try them against real SaaS accounts. If the password never changed and multi-factor authentication was absent, the login looked normal and the cloud service let them in, which is why a stale identity can become a current breach.
For organizations that let staff reach Snowflake from unmanaged endpoints, the exposure sits in the credential market and in identity hygiene, not in the warehouse service itself. That means the durable risk is every reused password that still opens a cloud account, even when the original stealer infection is long gone.