Stolen Qubole credentials used to steal customers' cloud data
From 14 to 26 October, an attacker exploited stolen Qubole AWS IAM credentials and trust relationships with customer accounts to infiltrate several customers' cloud environments. The attacker stole S3 files, secret keys and credentials associated with AWS, Microsoft Entra ID and Okta, exfiltrating millions of files from one customer. Access permissions remaining at companies that had stopped using the service were also exploited.
Key facts
- Affected organisation
- Qubole
- Incident type
- Data breach
- Occurred / detected
- 2026-10-14
- Scale of damage
- S3 files, secret keys and credentials stolen from several customers; millions of files exfiltrated from one customer
- Cause / method
- Exploitation of stolen Qubole AWS IAM credentials, trust relationships with customer accounts and residual access permissions
- Location
- Other countries
If your data was exposed
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- The attacker began exploiting Qubole AWS credentials to infiltrate customers' cloud environments.
- The confirmed period of intrusions into customers' cloud environments continued through this day.
- It emerged that access permissions remaining at companies that had stopped using the service had also been exploited.
- The exfiltration of millions of files from one customer was reported.
9 related reports
- Attacker Uses Qubole Access to Raid Customer AWS Accounts
- New Supply Chain Attack Compromises Tens of Thousands of GitHub Repositories
- Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data
- 黑客利用 Qubole 受信任的 AWS 访问权限入侵客户账户并窃取数据
- Qubole supply chain attack exposed AWS, Entra ID, and Okta credentials
- Over a Dozen Organizations Hit in Qubole Supply Chain Attack
- From One Vendor’s Stolen Credentials to Dozens of Customer AWS Accounts: A Timeline of the Qubole Trusted-Access Breach
- Hackers exploit trusted AWS access to breach multiple cloud environments
- 【資安日報】11月11日，駭客利用大數據平臺Qubole被竊憑證，入侵數十家企業AWS環境竊取資料
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.