Qubole Supply Chain Attack Exposed AWS, Entra ID, and Okta Credentials

Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials

An attacker has abused AWS cross-account IAM roles to access multiple customer environments, steal data, and harvest credentials in a supply-chain attack that ran between October 14 and October 26. Researchers from Wiz, working with Sentra and Mandiant, said they observed an attacker using IAM credentials for Qubole’s AWS account to assume roles in customer environments. The compromised credentials allowed the attacker to access customer AWS acc…

Qubole Trusted AWS Access Used to Reach Customer Accounts

Attackers abused Qubole's trusted AWS access to compromise customer cloud accounts and extract data. The intrusion path centered on inherited trust between the data platform and customer AWS environments, allowing activity inside...

Over a Dozen Organizations Hit in Qubole Supply Chain Attack

Hackers used leaked Qubole credentials to steal data from over a dozen organizations, including credentials, secrets, and files.

Hackers Exploit Trusted Qubole IAM Roles to Access AWS Accounts and Download Entire S3 Buckets

Hackers abused trusted Qubole integrations to enter customer AWS accounts, steal secrets, and download data from Amazon S3, sometimes taking entire buckets in one session. The activity ran from October 14 through October 26, 2026, using IAM credentials from an AWS account associated with Qubole rather than exploiting a software vulnerability. The attackers relied on […]

Hackers Abuse Qubole’s Trusted AWS Access to Breach Multiple Cloud Accounts and Steal Sensitive Data

Hackers abused AWS credentials associated with Qubole to breach multiple customer cloud environments, harvest secrets, and steal sensitive S3 data between… Read more →