[ad_1]
The cloud-based data warehousing firm Snowflake has found itself at the heart of a cybersecurity concern with reports suggesting that a number of its corporate clients might have had their cloud-stored data accessed without authorization.
Snowflake, headquartered in Boston, provides large organizations—including financial institutions, healthcare services, and technological enterprises—with data storage and analytical services on the cloud, holding vast volumes of sensitive customer information.
Concerns were raised by Australian cyber authorities last week, cautioning that “successful compromises of several companies utilising Snowflake environments” had occurred, although specific corporations were not identified. Claims on a cybercrime forum alleged that customer data amounting to hundreds of millions of records from notable Snowflake customers such as Santander Bank and Ticketmaster were stolen. Santander acknowledged a database breach “hosted by a third-party provider” but did not name Snowflake, while subsequently, Live Nation confirmed a breach at Ticketmaster, identifying Snowflake as the hosting service.
Snowflake released a statement acknowledging awareness of “potentially unauthorized access” occurring in a “limited number” of client accounts. While stating there was no direct evidence of intrusion into Snowflake’s own systems, the company pointed to a “targeted campaign directed at users with single-factor authentication” and stated that the illicit access involved credentials “previously purchased or obtained through infostealing malware.”
Snowflake’s approach allows its clients to manage their own environment’s security. Notably, Snowflake does not mandate clients to implement multi-factor authentication (MFA), as indicated by the company’s support documentation. This lack of compulsory MFA has been identified as a probable gap through which cyber attackers might have gained access to significant data stores.
There were revelations that even a demo account of Snowflake, protected merely by a username and password, had been compromised, although it was claimed to hold no sensitive data. Whether this breach is connected to the broader security issues remains unconfirmed.
The scale of the potential compromises became more evident with over 500 client login credentials reportedly sighted by TechCrunch, available on clandestine online venues for cybercriminals, hinting at more extensive vulnerabilities within Snowflake customer accounts.
TechCrunch viewed user logins for Snowflake that appeared to be stolen via malware that had infiltrated employees at companies confirmed as Snowflake clients. The compromised users included database engineers and data analysts.
Snowflake has advised customers to engage MFA protection immediately, minimizing the risk of future data breaches due to credential theft.
Methods Used to Check Exposed Data
A cybercrime informant directed TechCrunch to an online repository that hosts stolen user credentials. TechCrunch confirmed more than 500 usernames and passwords, paired with URLs for respective Snowflake environments.
These credentials were verified to be linked with actual Snowflake environment login pages for entities like Santander and Ticketmaster. Without testing the credentials to avoid legal contravention, other investigative methods showed that affected user logins were attached to corporately active Snowflake login addresses.
Further findings indicate that some of the employees whose accounts are implicated may have previously experienced malware attacks that compromised their computers.
Queries remained unanswered by Snowflake, although the company indicated proactive measures in silencing user accounts evidencing clear malicious activity. Snowflake highlighted customers’ responsibility for MFA implementation under the company’s “shared responsibility model.”
The Impact of Neglecting MFA Protocols
The unfolding scenario points to significant data security breaches being attributed to the absence of enforced MFA usage, with both Snowflake and its customers partaking in the accountability. The Ticketmaster incident alone, according to online sources, could encompass over 560 million customer records.
With recurring incidences of important data being compromised due to missing MFA securities, companies are embracing mandatory MFA to prevent an escalation of such security failures.
[ad_2]
Frequently Asked Questions (FAQ)
- What is Snowflake?
- Snowflake is a cloud-based data warehousing company that provides data storage and analytics services. It assists large corporations in managing and analyzing their vast stores of data, like customer information, in the cloud.
- What has happened with Snowflake’s customer credentials?
- Hundreds of customer credentials from Snowflake have been reported as accessible online. These are believed to have been obtained via info-stealing malware targeting company employees with access to Snowflake environments.
- Did Snowflake itself get breached?
- Snowflake has not found any evidence of a direct breach of its systems. They stated the issue stemmed from a targeted campaign against users with single-factor authentication using credentials acquired through malware.
- What should Snowflake customers do to secure their accounts?
- Snowflake has recommended that all customers enable multi-factor authentication (MFA) to secure their accounts against unauthorized access from stolen credentials.
- Has Snowflake mandated the use of MFA for its clients?
- No, Snowflake does not automatically enroll or require its customers to use MFA, leaving the security of their environments up to each customer’s discretion.
