Snowflake Customer Accounts Breached in Credential-Theft Campaign

A broad intrusion campaign compromised Snowflake customer environments including Ticketmaster, Santander and AT&T after attackers used credentials stolen by infostealer malware or bought on criminal forums, rather than exploiting a flaw in Snowflake itself. Reporting tied the activity to ShinyHunters, which advertised allegedly stolen data from Ticketmaster and Santander, while Mandiant said many affected accounts lacked multifactor authentication and that more than 100 customer environments were targeted. AT&T said the attackers accessed its Snowflake environment in April and stole call and text metadata for nearly 110 million customers, including numbers contacted, interaction counts and aggregate call durations, but not message content.

The campaign evolved from data theft into extortion, with victims receiving ransom demands and law enforcement pursuing suspects tied to the operation. Canadian authorities arrested a man from Kitchener, Ontario, in connection with the Snowflake hacking and extortion scheme, and reporting later indicated another suspected participant may have been a U.S. soldier. Government agencies including Australia’s Signals Directorate and U.S. investigators were drawn into the response, and AT&T said disclosure of its breach was temporarily delayed at the request of the FBI and DOJ because of national security and public safety concerns.