Breaches · 21h ago
Sekoia says the Snowflake thefts that hit at least 165 organizations in 2024 came from bought credentials, not a Snowflake flaw. The company ties the access to UNC5537 and the follow-on ShinyHunters extortion, and says some of the stolen logins had been scraped by infostealer malware as far back as 2020.
The pattern is simple: attackers buy credentials that infostealers already pulled from personal or contractor devices, then try them against real SaaS accounts. If the password never changed and multi-factor authentication was absent, the login looked normal and the cloud service let them in, which is why a stale identity can become a current breach.
For organizations that let staff reach Snowflake from unmanaged endpoints, the exposure sits in the credential market and in identity hygiene, not in the warehouse service itself. That means the durable risk is every reused password that still opens a cloud account, even when the original stealer infection is long gone.
1 source covering this story
Introducing Sekoia Digital Risk: Track Identity-Led Breaches
See how stolen credentials move from infostealers to access brokers, and how Sekoia connects exposure data to the actors behind identity-led breaches.
Part of the PlainSec briefing for 2026-10-13