In mid-2024, attackers gained unauthorized access to numerous customer environments hosted on Snowflake, with cybersecurity investigations indicating that stolen usernames and passwords harvested by infostealer malware were used to log in directly. Many affected accounts reportedly lacked multi-factor authentication, allowing access without an additional verification step. Mandiant, a Google Cloud subsidiary, reported that more than 160 customer environments may have been targeted or accessed. Listed victims included AT&T, Ticketmaster/Live Nation, Santander Bank, LendingTree, Advance Auto Parts, Neiman Marcus, and Bausch Health.
The stolen information was allegedly used in extortion campaigns associated with groups identified in reporting as UNC5537, Scattered Spider, or ShinyHunters; those attribution claims and the roles of specific individuals remained matters for law-enforcement and court proceedings in the supplied account. The most consequential exposure involved AT&T, whose call and text-message metadata covering nearly all U.S. customers was compromised. The U.S. Department of Justice asked AT&T to delay disclosure over national-security and public-safety concerns, and AT&T later reportedly paid $370,000 in ransom. The incident intensified scrutiny of cloud-provider responsibility, customer security configurations, MFA enforcement, credential hygiene, and third-party data risk.
