Threats · 2 days ago
Qubole breach reached customer secrets beyond stale AWS roles Wiz, working with Sentra and Mandiant, says the October 14–26 Qubole intrusion affected dozens of customers, with attackers stealing AWS data and testing credentials for AWS, Microsoft Entra ID, and Okta.
Customers had given Qubole’s AWS account permission to assume roles in their environments, and some roles remained trusted after the service was no longer in use. Using compromised Qubole credentials, the attacker accessed those roles, read data and retrieved secrets from AWS services. Wiz says the attacker used TruffleHog to check harvested AWS keys, Entra ID client secrets, and Okta credentials. That creates possible routes into other cloud and identity services, but Wiz has not established how far the credentials enabled further access.
For organizations that offboarded Qubole—or retain similar cross-account roles for other SaaS vendors—closing the AWS trust would not establish whether credentials already taken were used elsewhere.
Timeline Sources 6 sources covering this story
BleepingComputer Nov 10
Hackers exploit trusted AWS access to breach multiple cloud environments
A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments.
SecurityWeek Nov 10
Over a Dozen Organizations Hit in Qubole Supply Chain Attack
Hackers used compromised Qubole IAM credentials to steal customer files, secrets, keys, environment variables, and credentials.
CSO Online Nov 10
Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials
Attackers exploited cross-account IAM roles to access customer AWS environments, steal data, and harvest credentials for multiple cloud services.
The Register Security Nov 9
Attackers backdoor trusted AWS integrations to steal secrets
Wiz researchers uncovered the secret-stealing supply-chain attack
The Hacker News Nov 9
Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data
Attackers used Qubole AWS credentials to breach multiple customer accounts, steal cloud secrets, and copy S3 data through trusted IAM roles.
Wiz Research Nov 9
Trusted by Default: Qubole Cross-Account Access Abused in the Wild | Wiz Blog
A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments.
Vendor digest: Microsoft
Part of the PlainSec briefing for 2026-11-11
Editions Related stories Threats · 2 days ago
Qubole breach reached customer secrets beyond stale AWS roles Wiz, working with Sentra and Mandiant, says the October 14–26 Qubole intrusion affected dozens of customers, with attackers stealing AWS data and testing credentials for AWS, Microsoft Entra ID, and Okta.
Customers had given Qubole’s AWS account permission to assume roles in their environments, and some roles remained trusted after the service was no longer in use. Using compromised Qubole credentials, the attacker accessed those roles, read data and retrieved secrets from AWS services. Wiz says the attacker used TruffleHog to check harvested AWS keys, Entra ID client secrets, and Okta credentials. That creates possible routes into other cloud and identity services, but Wiz has not established how far the credentials enabled further access.
For organizations that offboarded Qubole—or retain similar cross-account roles for other SaaS vendors—closing the AWS trust would not establish whether credentials already taken were used elsewhere.
Timeline Sources 6 sources covering this story
BleepingComputer Nov 10
Hackers exploit trusted AWS access to breach multiple cloud environments
A threat actor used compromised identity and access management (IAM) credentials for a Qubole big data platform's AWS account to access and exfiltrate data from multiple customers' AWS environments.
SecurityWeek Nov 10
Over a Dozen Organizations Hit in Qubole Supply Chain Attack
Hackers used compromised Qubole IAM credentials to steal customer files, secrets, keys, environment variables, and credentials.
CSO Online Nov 10
Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials
Attackers exploited cross-account IAM roles to access customer AWS environments, steal data, and harvest credentials for multiple cloud services.
The Register Security Nov 9
Attackers backdoor trusted AWS integrations to steal secrets
Wiz researchers uncovered the secret-stealing supply-chain attack
The Hacker News Nov 9
Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data
Attackers used Qubole AWS credentials to breach multiple customer accounts, steal cloud secrets, and copy S3 data through trusted IAM roles.
Wiz Research Nov 9
Trusted by Default: Qubole Cross-Account Access Abused in the Wild | Wiz Blog
A threat actor used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments.
Vendor digest: Microsoft
Part of the PlainSec briefing for 2026-11-11
Editions Related stories