Snowflake: stolen passwords, missing MFA, exposed customer data

About this series

The theft of millions of records

In the middle of 2024, news broke that several large consumer brands had suffered massive data thefts. Ticketmaster reported that data for 560 million customers was taken. Santander Bank and others followed with similar reports. The common thread was Snowflake, a popular cloud data-warehouse platform used to store vast amounts of business information.

This was not a breach of Snowflake's own infrastructure. Instead, a threat group known as UNC5537 targeted individual customer accounts. They used credentials that had been stolen by infostealer malware, often months or even years earlier. The attackers found that many of these high-value accounts were protected only by a username and password, with no Multi-factor authentication (MFA) (show definition) in place.

How infostealer malware works

Infostealers are a type of malware designed to scrape saved passwords, browser cookies, and session tokens from a computer. They are often spread through cracked software, fake updates, or Phishing (show definition) emails. Once the data is stolen, it is sold on criminal forums in 'logs.'

The Snowflake incident showed that a password stolen from a personal computer or a contractor's laptop could be used to log into a corporate data platform. Because some of the stolen credentials were years old, the victims didn't even know they were at risk. The attackers simply waited until they had a valid set of credentials and then logged in as if they were the legitimate owner.

The danger of dormant accounts

Many of the compromised Snowflake accounts were dormant or unmonitored. When an employee leaves or a project ends, their accounts often remain active. These 'ghost' accounts are perfect targets because no one is watching the logs for unusual activity. In the Snowflake case, the attackers could export massive amounts of data without being noticed until the records appeared for sale online.

For a small or mid-sized business, this highlights the need for a strict offboarding process. If an account isn't being used, it should be disabled. If it must stay active, it must be monitored.

Three lessons for today

The Snowflake incident was a wake-up call for how we manage access to cloud platforms. The following three principles are the best defense against this type of credential theft.

• MFA everywhere. There is no excuse for a cloud account to lack multi-factor authentication. This includes service accounts and administrative consoles.
• Least privilege. Users should only have access to the data they need for their current job. If a compromised account only has access to a small slice of data, the damage is contained.
• Data minimization. Do not store data you don't need. The more data you keep in one place, the bigger the target you become for extortion.

Security checklist for cloud data

• Verify MFA is active and required for all users in every cloud platform
• Audit all active accounts and disable any that belong to former employees or contractors
• Review access logs for logins from unusual locations or at unusual times
• Rotate passwords for any accounts that have been active for more than a year without a change
• Set up alerts for large data exports or unusual download volumes

A permanent shift in risk

The threat from infostealer malware is not going away. As long as people save passwords in browsers and work from personal devices, credentials will continue to leak. The Snowflake breaches proved that the only reliable defense is to assume that your passwords might already be stolen. By requiring a second factor for every login and watching for anomalies, you take away the attacker's easiest path to your data.