Security firms Mandiant and CrowdStrike reported a campaign against Snowflake customer environments beginning in April 2024. The attackers used credentials obtained from infostealer malware and did not exploit a vulnerability in Snowflake's platform. Accounts without multifactor authentication were the main entry point.
Affected companies included Ticketmaster and Santander, which confirmed unauthorized access to customer data. Threat actors later listed stolen records for sale on cybercrime forums. Snowflake said it rolled out mandatory multifactor authentication for new accounts and added more policy controls.
Investigators tied the activity to a financially motivated group tracked as UNC5537. The group targeted hundreds of Snowflake customer instances using valid credentials. Companies should enforce multifactor authentication, review account activity, and rotate credentials.