Snowflake (data breach)

Snowflake Customer Data Breach

In 2024, a group of hackers conducted a data breach targeting Snowflake Inc. cloud servers, compromising the data of over 100 customers [1][2][3]. The stolen information encompassed personally identifiable information (PII), banking records, event ticket bar codes [4][5], medical data, and customer call records reportedly linked to nearly all AT&T customers.[6][7][8]

## Incident details

[edit]

According to Mandiant, hackers associated with the group UNC5537, also known as Scattered Spider, gained unauthorized access to Snowflake customer cloud instances using only usernames and passwords.[9][10]

The attackers exploited login credentials obtained through infostealer malware to access significant volumes of sensitive customer data stored in Snowflake accounts. These accounts were accessed without the need for multi-factor authentication, relying solely on usernames and passwords.[11]

Victim companies reportedly included AT&T, Ticketmaster, Santander Bank, LendingTree, Advance Auto Parts, Neiman Marcus, and Los Angeles Public Schools.[12][13][14][15] The breach of AT&T customer data is notable as it marks the first known instance in which the U.S. Department of Justice requested a company to delay filing a disclosure with the Securities and Exchange Commission (SEC) due to concerns over potential national security or public safety risks.[16][17][18]

## The hackers

[edit]

The two individuals implicated in the mass data breach were identified as Connor Riley Moucka, 25, known online by aliases such as "Waifu," "Judische," and "Ellyel8," and John Erin Binns, 24, who used aliases including "IRDev" and "IntelSecrets."[19] Moucka was arrested on October 30, 2024, in Kitchener, Ontario, Canada, and charged with conspiracy, computer fraud and abuse, extortion, and aggravated identity theft. Binns was apprehended in Turkey in late May 2024 and is currently held in a Turkish prison.[20][21]

## References

[edit]

1. ^ Coleman, Julie (2024-08-21). "Snowflake says data breach has not affected core business". CNBC. Retrieved 2025-01-16.
2. ^ "Snowflake to Close Hacking Probe Into Attack Targeting Clients". Bloomberg.com. 2024-06-13. Retrieved 2025-01-16.
3. ^ "Hackers Demand as Much as $5 Million From Snowflake Clients". Bloomberg.com. 2024-06-17. Retrieved 2025-01-16.
4. ^ "Ticketmaster confirms data hack". www.bbc.com. Retrieved 2025-01-16.
5. ^ "Ticketmaster hack: Customers told to sign up to security service". www.bbc.com. Retrieved 2025-01-16.
6. ^ Novet, Jordan (2024-07-12). "AT&T's massive data breach deepens crisis for Snowflake seven weeks after hack was disclosed". CNBC. Retrieved 2025-01-14.
7. ^ Zetter, Kim. "AT&T Paid a Hacker $370,000 to Delete Stolen Phone Records". Wired. ISSN 1059-1028. Retrieved 2025-01-14.
8. ^ Novet, Jordan (2024-07-12). "AT&T's massive data breach deepens crisis for Snowflake seven weeks after hack was disclosed". CNBC. Retrieved 2025-01-16.
9. ^ "UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion". Google Cloud Blog. Retrieved 2025-01-14.
10. ^ "Charges unsealed for Snowflake hacker". www.bloomberg.com. 11 November 2024. Retrieved 2025-01-14.
11. ^ Zetter, Kim. "Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake". Wired. ISSN 1059-1028. Retrieved 2025-01-14.
12. ^ Burgess, Matt. "The Snowflake Attack May Be Turning Into One of the Largest Data Breaches Ever". Wired. ISSN 1059-1028. Retrieved 2025-01-14.
13. ^ "Advance Auto Parts stolen data for sale after Snowflake attack". BleepingComputer. Retrieved 2025-01-14.
14. ^ "Hackers Demand as Much as $5 Million From Snowflake Clients". Bloomberg.com. 2024-06-17. Retrieved 2025-01-16.
15. ^ "Ticketmaster confirms data hack". www.bbc.com. Retrieved 2025-01-16.
16. ^ "AT&T says hackers stole records of nearly all cellular customers' calls and texts". NBC News. 2024-07-12. Retrieved 2025-01-14.
17. ^ Maruf, Ramishah (2024-07-18). "AT&T is telling customers they were hacked. Protecting data has been a big fight – from companies like AT&T | CNN Business". CNN. Retrieved 2025-01-14.
18. ^ Novet, Jordan (2024-07-12). "AT&T's massive data breach deepens crisis for Snowflake seven weeks after hack was disclosed". CNBC. Retrieved 2025-01-16.
19. ^ "Scattered Spider Pivots to SaaS Application Attacks". www.darkreading.com. Retrieved 2025-01-16.
20. ^ Monga, Robert McMillan and Vipal. "He Investigates the Internet's Most Vicious Hackers—From a Secret Location". WSJ. Retrieved 2025-01-14.
21. ^ "Snowflake hackers still at large". www.bloomberg.com. 20 September 2024. Retrieved 2025-01-14.