● Covered by 2 sources · 2 reportsMedium impact2 negative
Qubole Customer AWS Accounts Breached via Compromised Vendor Credentials
Key points
- Attacker used compromised Qubole AWS account credentials.
- Breach occurred between October 14 and October 26, affecting multiple customers.
- IAM roles in customer AWS accounts were assumed to steal data and secrets.
- Even unused IAM roles with trust policies for Qubole were exploited.
- Organizations that connected Qubole to AWS should check CloudTrail logs from October 1.
Overview of the Breach
Between October 14 and October 26, an attacker gained unauthorized access to AWS accounts belonging to multiple Qubole customers. The breach involved the theft of stored secrets and data from these customer environments. Cloud security company Wiz and Sentra independently reported on the incident, which is characterized as a supply chain attack.
Exploitation Method
The attacker obtained credentials for an AWS account used by Qubole's platform. Qubole, a data lake platform, operates within its customers' AWS accounts through IAM roles. These roles have trust policies allowing Qubole's AWS account to assume them, provided a matching External ID is included in the AssumeRole request. The attacker leveraged these compromised Qubole credentials and the correct External ID to assume IAM roles within customer accounts, thereby gaining access to their data.
A significant aspect of the attack was the exploitation of both active and unused IAM roles. According to Wiz researchers, many of the assumed roles were not actively in use, yet their existing trust relationships with Qubole's account made them vulnerable.
Impact and Discovery
Dozens of Qubole customers were impacted by this attack. The attacker's actions primarily involved reading passwords and keys, with no reported write actions. Sentra discovered the attack and uncovered its scope across multiple organizations.
The incident underscores the risks associated with third-party vendor integrations and the persistence of access permissions. Vendor integrations, automation, and AI agents often hold standing access to cloud data, and if compromised, can provide a pathway into customer environments, even for connections that are no longer actively used.
Recommendations for Affected Organizations
Any organization that has previously connected Qubole to their AWS environment, regardless of current usage, is advised to review their CloudTrail logs. Specifically, they should look for AssumeRole requests originating from Qubole's platform AWS account (805246085872) from October 1 onward. This will help identify any unauthorized access attempts or successful breaches related to this incident.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
A supply chain attack compromised dozens of Qubole customers after an attacker obtained Qubole credentials. The attacker used existing, often forgotten, Qubole access roles to exfiltrate data from multiple organizations. Sentra discovered the attack, which involved reading passwords and keys without making any write actions.
An attacker exploited Qubole's trusted AWS access to breach multiple customer accounts between October 14 and October 26, stealing stored secrets and data. The attacker used compromised credentials for a Qubole AWS account to assume IAM roles within customer environments, even for unused roles, due to the trust policy and correct External ID being present in requests.