🚨Qubole Supply-Chain Attack Drained S3 Buckets Across Multiple AWS Customers

Rotate your Qubole credentials before someone else does

Attackers used stolen credentials tied to Qubole's own AWS account to walk into customer environments and steal data. Entire S3 buckets, plus secrets from Lambda, Secrets Manager, and SSM Parameter Store, are gone. This is a supply-chain hit, and it's not a fluke. If you use Qubole, you're exposed through a cross-account IAM role that Qubole uses to manage compute and reach your storage. The attacker didn't need to touch your account directly. They rode the trust relationship you already set up. Any secret that role could read should be treated as burned. The timeline starts October 14, when sts:AssumeRole calls came from Qubole account 805246085872. Activity continued on October 15 and 18. Wiz also saw a separate campaign from October 8 to 11 that used customer AWS keys for Qubole integrations, though it isn't confirmed as the same actor. The attackers ran TruffleHog against victim credentials and requested Okta OAuth tokens. Wiz hasn't attributed the campaign to a group or seen what happens to the stolen data.