The Snowflake Data Breach: A Comprehensive Overview

In June 2024, a significant data breach involving Snowflake, a leading cloud-based data storage and analytics provider, came to light. This incident affected numerous high-profile companies and millions of individuals, raising concerns about data security in cloud environments. 

The Snowflake breach highlights the importance of increasing and improving data security solutions in cloud environments, such as implementing robust security measures, regularly updating credentials, and maintaining vigilant monitoring of cloud-based systems. 

This article thoroughly examines the Snowflake breach, its impact, and the lessons learned.

What is the Snowflake breach

The Snowflake data breach was a series of targeted attacks on multiple Snowflake customer instances. A cybersecurity firm investigating the incident alongside Snowflake identified a financially motivated threat actor group whose actions are tracked as UNC5537.

What is UNC5537

UNC5537 is how Mandiant tracks the malicious activity linked to a single threat actor group targeting Snowflake database customers. These cybercriminals specialize in stealing sensitive data from organizations utilizing Snowflake’s cloud-based data warehousing platform. 

Their primary method involves exploiting compromised credentials obtained from infostealer malware. 

The UNC5537 campaign poses a significant threat to organizations relying on Snowflake for data storage and management. Their ability to exploit compromised credentials and bypass MFA highlights the critical importance of robust security measures, including strong password hygiene, MFA implementation, and ongoing monitoring for suspicious activity.

How did the Snowflake breach happen?

UNC5537 accessed Snowflake customer instances using stolen credentials and accounts lacking multi-factor authentication (MFA). These credentials were primarily obtained through various infostealer malware campaigns that infected non-Snowflake-owned systems. Some of the stolen credentials date back to 2020, highlighting the long-term risks of compromised login information.

Three primary factors led to numerous successful compromises:

1. Lack of multi-factor authentication (MFA) on impacted accounts
2. Use of outdated credentials that had been stolen years ago
3. The absence of a network allows lists to restrict access to trusted locations

Once inside a Snowflake database, UNC5537 employs a custom tool named “rapeflake” to conduct reconnaissance and potentially exploit vulnerabilities. They then exfiltrate large volumes of data using a series of SQL commands. After stealing the data, the threat actors commit extortion, demanding ransom payments from their victims. Additionally, they often sell the stolen data on cybercrime forums for profit.

High-profile Snowflake data breach victims

Snowflake became a well-known case because several companies were affected by it, including the Ticketmaster data breach, one of the most significant breaches in 2024. 

Disclaimer: It’s important to note that the associated breaches were not confirmed by the time this article was published.

Ticketmaster

Live Nation, Ticketmaster’s parent company, confirmed unauthorized access to a third-party cloud database environment containing primarily Ticketmaster data. The breach potentially impacted 560 million customers.

Santander Bank

Santander announced unauthorized access to a database hosted by a third-party provider, affecting approximately 30 million customers.

AT&T

AT&T disclosed that call and text records of nearly all its cellular customers from May 1, 2022, to October 31, 2022, and on January 2, 2023, were compromised. This breach affected around 110 million customers.

Advance Auto Parts

Advance Auto Parts reported that between April 14 and May 24, 2024, unauthorized access to its Snowflake environment exposed more than 2.3 million people’s personal information.

Snowflake’s response

Snowflake maintains that the incidents resulted from compromised user credentials rather than any inherent vulnerabilities or flaws within Snowflake’s product itself. The company has been working with affected customers and has provided detailed detection and hardening guidance.

Lessons learned and cybersecurity best practices

After every data breach, new lessons are learned. However, old human errors persist, which increases the chances of threat actors being successful in their quest.

The Snowflake breach teaches us the importance of applying a few basic cybersecurity solutions. To improve their data security, users and businesses can use the following solutions.

Enable multi-factor authentication (MFA)

One of the entry points during the breach was weak credentials with no MFA method. Implementing MFA adds a layer of security, making unauthorized access more challenging as the account owner must authorize any new access.

Regular credential rotation

Old credentials facilitated cybercriminals’ access to users’ accounts, leading to the data breach. To prevent this, regularly update and rotate credentials, especially for accounts with extensive permissions.

Monitor for suspicious activity

Review logs for executed queries, especially those involving external data access or potentially exposing sensitive information.

Apply zero-trust policy

To prevent unauthorized access across your network, you can ensure that each person on your staff has access only to the necessary information for them to perform their daily tasks.