Hackers used a data vendor's keys to steal from dozens of firms

A hacker stole login credentials from Qubole, a data analytics company, and used them to walk into the Amazon Web Services (AWS) accounts of its customers. Between October 14 and 26, the attacker downloaded data from tens of companies. In some cases the connection to Qubole was a setup nobody was using anymore.

What happened

Qubole sells software that helps companies manage large piles of data. To do that, customers can give it access to their AWS cloud accounts through a feature called a cross-account role. Think of it as a spare key handed to a trusted vendor.

Researchers at Wiz found the attacker had taken over two Qubole user accounts. With them, the attacker used spare keys that customers had set up earlier, including ones that sat idle. Once inside, the attacker looked around, collected stored passwords and access keys, and then downloaded files from every storage area (called S3 buckets) the role could reach.

How fast it moved

The attacker did not pick targets carefully. Wiz describes the approach as opportunistic: take whatever is reachable. Sentra, the security firm that first flagged odd activity, says the attacker gathered about 100 passwords and keys in seven minutes. Sentra confirmed dozens of victims and millions of files stolen from one customer alone.

The stolen secrets were also tested. The attacker checked whether the AWS keys, Microsoft Entra ID secrets and Okta credentials actually worked. Those are the kinds of logins that can open doors beyond one cloud account.

Who should worry

The victims were companies whose AWS accounts had roles set up to trust an AWS account linked to Qubole. If your company ever made that connection, even for a trial or an old project, treat it as a possible exposure. If you never linked Qubole to your cloud accounts, this campaign as described does not reach you.

What to do

The alert box above lists the steps for technical staff. In short, look back at your cloud logs, replace anything that may have leaked, and cut off vendor connections you no longer need. If you do not run your own cloud, ask whoever does to check this week.

What is still unknown

The report does not say how the Qubole accounts were compromised. It also does not give the full number of affected companies. BleepingComputer could not find a public statement from Qubole and has emailed the company for comment. Wiz, with help from Mandiant, did the investigation. Expect more details as victims and Qubole respond.