🔓Attacker Steals Data From Dozens of Qubole Customers Via Supply Chain Hit

Your cloud credentials might already be in someone else's hands

Somebody got into dozens of Qubole customer environments through a supply chain attack and walked off with data. The speed is what should scare you. The attacker hopped from company to company using stolen credentials, and in seven minutes pulled over 100 passwords and keys from three separate places. If you run data pipelines on Qubole, or any setup where Qubole has trusted IAM roles, this one is yours. The attacker tested stolen creds on one low-value role first, then went wide, entering every Qubole-trusted role and kicking off bulk downloads. Lambda environment variables and EC2 user data were harvested too, which means secrets you thought were tucked away weren't. Qubole's own network didn't catch any of it. The numbers: thousands of credential records and files downloaded, zero write actions, and access routed through a rented OVH server and Mullvad VPN. Sentra traced the leaked samples back to a handful of S3 buckets by matching them against data it had already scanned. One external identity, Qubole, could read most of those source buckets. Proving what was taken was the hard part, since most cloud storage doesn't log every file read by default.