Cloud data analytics company Snowflake is at the center of a recent wave of alleged data thefts as its enterprise customers try to figure out if their cloud data stores have been compromised.
Snowflake helps some of the world’s largest companies – including banks, healthcare providers and technology companies – store and analyze massive amounts of data, such as customer data, in the cloud.
Last week, Australian authorities sounded the alarm saying they were aware of “successful compromises of several companies using Snowflake environments,” without naming the companies. The hackers had claimed on a well-known cybercrime forum that they had stolen hundreds of millions of customer records from Santander Bank and Ticketmaster, two of Snowflake’s biggest customers. Santander confirmed database breach “hosted by a third party provider”, but does not name that provider. On Friday, Live Nation confirmed that its Ticketmaster subsidiary had been hacked and that the stolen database was hosted on Snowflake.
Snowflake recognized in a brief statement that it was aware of “potentially unauthorized access” to a “limited number” of customer accounts, without specifying which ones, but that it found no evidence of a direct breach of its systems. Instead, Snowflake called it a “targeted campaign targeting users with single-factor authentication” and that the hackers used “previously purchased or information-stealing malware” designed to scrape a user’s saved passwords from his computer.
Despite the sensitive data Snowflake maintains about its customers, Snowflake allows each customer to manage the security of their environment and does not automatically enroll or require its customers to use multi-factor authentication or MFA; according to the Snowflake customer documentation. Not enforcing the use of MFA appears to be how cybercriminals allegedly obtained massive amounts of data from some Snowflake customers, some of whom were setting up their environments without the added security measure.
Snowflake admitted that one of its own “demo” accounts was compromised because it was not protected beyond a username and password, but claimed that the account “did not contain any sensitive data”. It is unclear if this stolen demo account has any role in the recent breaches.
TechCrunch this week saw hundreds of alleged Snowflake customer credentials available online for cybercriminals to use as part of hacking campaigns, suggesting that the risk of Snowflake customer account compromises may be much greater than first known.
The credentials were stolen by malware infecting the computers of employees accessing their employer’s Snowflake environment.
Some of the credentials seen by TechCrunch appear to belong to employees at companies known to be customers of Snowflake, including Ticketmaster and Santander, among others. Employees with access to Snowflake include database engineers and data analysts, some of whom report their experience using Snowflake on their LinkedIn pages.
For its part, Snowflake has told customers to immediately enable MFA for their accounts. Until then, Snowflake accounts that don’t enforce the use of MFA to sign in leave their stored data at risk of being compromised by simple attacks like password theft and reuse.
How we checked the data
A source with knowledge of cybercriminal activity directed TechCrunch to a site where would-be attackers can search for lists of credentials stolen from various sources, such as stealing malware on someone’s computer or collecting from previous data breaches. (TechCrunch does not link to the site where stolen credentials are available, so as not to help bad actors.)
In total, TechCrunch has seen more than 500 credentials containing employee usernames and passwords, along with the web addresses of the login pages for the corresponding Snowflake environments.
The exposed credentials appear to be Snowflake environments owned by Santander, Ticketmaster, at least two pharmaceutical giants, a food delivery service, a public freshwater supplier and others. We also saw exposed usernames and passwords allegedly belonging to a former Snowflake employee.
TechCrunch is not naming the former employee because there is no evidence they did anything wrong. (It is ultimately the responsibility of both Snowflake and its customers to implement and enforce security policies that prevent intrusions resulting from the theft of employee credentials.)
We didn’t test for stolen usernames and passwords, as doing so would break the law. Therefore, it is unknown if the credentials are currently in use or if they directly led to account breaches or data theft. Instead, we worked to verify the authenticity of exposed credentials in other ways. This includes checking the individual login pages of the Snowflake environments exposed by the information-stealing malware, which was still active and connected at the time of writing.
The credentials we’ve seen include the employee’s email address (or username), their password, and the unique web address to log into their company’s Snowflake environment. When we checked the web addresses of Snowflake environments — which are often made up of random letters and numbers — we found that registered Snowflake customer login pages are publicly accessible, even if they are not searchable online.
TechCrunch has confirmed that the Snowflake environments correspond to the companies whose employee credentials were compromised. We were able to do this because every login page we checked had two separate options to log in.
One way to sign in is based on Okta, a single sign-on provider that allows Snowflake users to sign in with their company’s corporate credentials using MFA. In our checks, we found that these Snowflake login pages were redirected to the Live Nation (for Ticketmaster) and Santander login pages. We also found a set of credentials belonging to a Snowflake employee whose Okta login page still redirected to an internal Snowflake login page that no longer exists.
The other Snowflake login option allows the user to use only their Snowflake username and password, depending on whether the enterprise customer enforces MFA on the account, as described by Snowflake’s own support documentation. It is these credentials that appear to have been stolen by the malware stealing information from employees’ computers.
It’s unclear exactly when the employees’ credentials were stolen or how long they were online.
There is some evidence to suggest that several employees with access to their company’s Snowflake environments have previously had their computers compromised by information-stealing malware. According to an audit for the breach notification service Have I Been Pwned, several of the corporate email addresses used as usernames to access Snowflake environments were found in a recent data dump containing millions of stolen passwords is scraped from various Telegram channels used to share stolen passwords.
Snowflake spokeswoman Danica Stanczak declined to answer specific questions from TechCrunch, including whether any of its customers’ data was found in the Snowflake employee’s test account. In a statement, Snowflake said it is “suspending some user accounts where there is strong evidence of malicious activity.”
Snowflake added: “Under Snowflake’s shared responsibility model, customers are responsible for enforcing MFA with their users.” The spokesperson said that Snowflake is “looking at all options for enabling MFA, but we have not finalized any plans at this time.”
When reached by email, Live Nation spokeswoman Kaitlyn Henrich had no comment as of press time.
Santander did not respond to a request for comment.
The lack of MFA has resulted in massive breaches
Snowflake’s response so far leaves many questions unanswered and reveals a number of companies that are not reaping the benefits that MFA security provides.
What is clear is that Snowflake bears at least some responsibility for not requiring its users to enable security mode, and now bears the brunt of it — along with its customers.
The data breach at Ticketmaster reportedly involved more than 560 million customer records, according to cybercriminals who advertised the data online. (Live Nation would not comment on how many customers are affected by the breach.) If proven, Ticketmaster would be the largest data breach in the US so far this year and one of the largest in recent history.
Snowflake is the latest company in a series of high-profile security incidents and major data breaches caused by a lack of MFA.
Last year, cybercriminals deleted about 6.9 million customer records from 23andMe accounts that weren’t protected without MFA, prompting the genetic testing company — and its competitors — to require users to enable MFA by default to prevent a repeat attack.
And earlier this year, UnitedHealth-owned health tech giant Change Healthcare admitted hackers broke into its systems and stole massive amounts of sensitive health data from a system not protected by MFA. The healthcare giant has not yet said how many people had their information breached, but said it was likely to affect a “significant percentage of people in America”.
Do you know more about Snowflake account hacks? Getting in touch. To contact this reporter, please contact Signal and WhatsApp at +1 646-755-8849 or via email. You can also send files and documents via SecureDrop.
