A defendant admitted helping steal data from at least 165 Snowflake customers
The case shows how reused or poorly protected cloud credentials can scale into mass extortion.
SOURCE · BleepingComputerTHE BRIEF
A Canadian defendant pleaded guilty to participating in attacks that accessed Snowflake customer accounts and stole data from at least 165 organizations as part of an extortion scheme.
WHY IT MATTERS
The campaign demonstrated that attackers can scale credential-based access across many tenants without breaking the cloud provider’s core infrastructure. Identity hygiene and logging remain customer responsibilities.
WHO SHOULD CARE
Cloud-data customers, identity teams, data owners and organizations using third-party integrations.
WHAT TO DO NOW
- Enforce MFA and remove dormant cloud accounts.
- Restrict access by network, role and workload where practical.
- Alert on large exports, unusual clients and newly created access tokens.
VERIFICATION NOTE
Source basis: BleepingComputer reporting on the guilty plea and associated case.
SecBriefs adds context and practical guidance. Reporting remains credited and linked to the original publisher.