Qubole breach reached customer secrets beyond stale AWS roles
Wiz, working with Sentra and Mandiant, says the October 14–26 Qubole intrusion affected dozens of customers, with attackers stealing AWS data and testing credentials for AWS, Microsoft Entra ID, and Okta.
Customers had given Qubole’s AWS account permission to assume roles in their environments, and some roles remained trusted after the service was no longer in use. Using compromised Qubole credentials, the attacker accessed those roles, read data and retrieved secrets from AWS services. Wiz says the attacker used TruffleHog to check harvested AWS keys, Entra ID client secrets, and Okta credentials. That creates possible routes into other cloud and identity services, but Wiz has not established how far the credentials enabled further access.
For organizations that offboarded Qubole—or retain similar cross-account roles for other SaaS vendors—closing the AWS trust would not establish whether credentials already taken were used elsewhere.
Hackers exploit trusted AWS access to breach multiple cloud environments
A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments.