Hundreds of Snowflake customer passwords found online are linked to info-stealing malware

Cloud data analysis company Snowflake is at the center of a recent spate of alleged data thefts, as its corporate customers scramble to understand if their stores of cloud data have been compromised. 

The Boston-based data giant helps some of the largest global corporations — including banks, healthcare providers and tech businesses — store and analyze their vast amounts of data, such as customer data, in the cloud.

Last week, Australian authorities sounded the alarm saying they had become aware of “successful compromises of several businesses utilising Snowflake environments,” without naming the businesses. Hackers had claimed on a known cybercrime forum that they had stolen hundreds of millions of customer records from Santander Bank and Ticketmaster, two of Snowflake’s biggest customers. Santander confirmed a breach of a database “hosted by a third-party provider,” but would not name the provider in question. On Friday, Live Nation confirmed that its Ticketmaster subsidiary was hacked and that the stolen database was hosted on Snowflake. 

Snowflake acknowledged in a brief statement that it was aware of “potentially unauthorized access” to a “limited number” of customer accounts, without specifying which ones, but that it has found no evidence there was a direct breach of its systems. Rather, Snowflake called it a “targeted campaign directed at users with single-factor authentication” and that the hackers used “previously purchased or obtained through infostealing malware,” which is designed to scrape a user’s saved passwords from their computer.

Despite the sensitive data that Snowflake holds for its customers, Snowflake lets each customer manage the security of their environments, and does not automatically enroll or require its customers to use multi-factor authentication, or MFA, according to Snowflake’s customer documentation. Not enforcing the use of MFA appears to be how cybercriminals allegedly obtained huge amounts of data from some of Snowflake’s customers, some of which set up their environments without the additional security measure. 

Snowflake conceded that one of its own “demo” accounts was compromised because it wasn’t protected beyond a username and password, but claimed the account “did not contain sensitive data.” It’s unclear if this stolen demo account has any role in the recent breaches. 

TechCrunch has this week seen hundreds of alleged Snowflake customer credentials that are available online for cybercriminals to use as part of hacking campaigns, suggesting that the risk of Snowflake customer account compromises may be far wider than first known. 

The credentials were stolen by infostealing malware that infected the computers of employees who have access to their employer’s Snowflake environment.

Some of the credentials seen by TechCrunch appear to belong to employees at businesses known to be Snowflake customers, including Ticketmaster and Santander, among others. The employees with Snowflake access include database engineers and data analysts, some of whom reference their experience using Snowflake on their LinkedIn pages.

For its part, Snowflake has told customers to immediately switch on MFA for their accounts. Until then, Snowflake accounts that aren’t enforcing the use of MFA to log in are putting their stored data at risk of compromise from simple attacks like password theft and reuse. 

How we checked the data

A source with knowledge of cybercriminal operations pointed TechCrunch to a website where would-be attackers can search through lists of credentials that have been stolen from various sources, such as infostealing malware on someone’s computer or collated from previous data breaches. (TechCrunch is not linking to the site where stolen credentials are available so as not to aid bad actors.)

In all, TechCrunch has seen more than 500 credentials containing employee usernames and passwords, along with the web addresses of the login pages for the corresponding Snowflake environments. 

The exposed credentials appear to pertain to Snowflake environments belonging to Santander, Ticketmaster, at least two pharmaceutical giants, a food delivery service, a public-run freshwater supplier, and others. We have also seen exposed usernames and passwords allegedly belonging to a former Snowflake employee. 

TechCrunch is not naming the former employee because there’s no evidence they did anything wrong. (It’s ultimately both the responsibility of Snowflake and its customers to implement and enforce security policies that prevent intrusions that result from the theft of employee credentials.) 

We did not test the stolen usernames and passwords as doing so would break the law. As such, it’s unknown if the credentials are currently in active use or if they directly led to account compromises or data thefts. Instead, we worked to verify the authenticity of the exposed credentials in other ways. This includes checking the individual login pages of the Snowflake environments that were exposed by the infostealing malware, which were still active and online at the time of writing.

The credentials we’ve seen include the employee’s email address (or username), their password, and the unique web address for logging in to their company’s Snowflake environment. When we checked the web addresses of the Snowflake environments — often made up of random letters and numbers — we found the listed Snowflake customer login pages are publicly accessible, even if not searchable online.

TechCrunch confirmed that the Snowflake environments correspond to the businesses whose employees’ logins were compromised. We were able to do this because each login page we checked had two separate options to sign in.

One way to login relies on Okta, a single sign-on provider that allows Snowflake users to sign in with their own company’s corporate credentials using MFA. In our checks, we found that these Snowflake login pages redirected to Live Nation (for Ticketmaster) and Santander sign-in pages. We also found a set of credentials belonging to a Snowflake employee, whose Okta login page still redirects to an internal Snowflake login page that no longer exists.

Snowflake’s other login option allows the user to use only their Snowflake username and password, depending on whether the corporate customer enforces MFA on the account, as detailed by Snowflake’s own support documentation. It’s these credentials that appear to have been stolen by the infostealing malware from the employees’ computers.

It’s not clear exactly when the employees’ credentials were stolen or for how long they have been online. 

There is some evidence to suggest that several employees with access to their company’s Snowflake environments had their computers previously compromised by infostealing malware. According to a check on breach notification service Have I Been Pwned, several of the corporate email addresses used as usernames for accessing Snowflake environments were found in a recent data dump containing millions of stolen passwords scraped from various Telegram channels used for sharing stolen passwords.

Snowflake spokesperson Danica Stanczak declined to answer specific questions from TechCrunch, including whether any of its customers’ data was found in the Snowflake employee’s demo account. In a statement, Snowflake said it is “suspending certain user accounts where there are strong indicators of malicious activity.”

Snowflake added: “Under Snowflake’s shared responsibility model, customers are responsible for enforcing MFA with their users.” The spokesperson said Snowflake was “considering all options for MFA enablement, but we have not finalized any plans at this time.”

When reached by email, Live Nation spokesperson Kaitlyn Henrich did not comment by press time.

Santander did not respond to a request for comment.

Missing MFA resulted in huge breaches

Snowflake’s response so far leaves a lot of questions unanswered, and lays bare a raft of businesses that are not reaping the benefits that MFA security provides. 

What is clear is that Snowflake bears at least some responsibility for not requiring its users to switch on the security feature, and is now bearing the brunt of that — along with its customers.

The data breach at Ticketmaster allegedly involves upwards of 560 million customer records, according to the cybercriminals advertising the data online. (Live Nation would not comment on how many customers are affected by the breach.) If proven, Ticketmaster would be the largest U.S. data breach of the year so far, and one of the biggest in recent history.

Snowflake is the latest company in a string of high-profile security incidents and sizable data breaches caused by the lack of MFA. 

Last year, cybercriminals scraped around 6.9 million customer records from 23andMe accounts that weren’t protected without MFA, prompting the genetic testing company — and its competitors — to require users enable MFA by default to prevent a repeat attack.

And earlier this year, the UnitedHealth-owned health tech giant Change Healthcare admitted hackers broke into its systems and stole huge amounts of sensitive health data from a system not protected with MFA. The healthcare giant hasn’t yet said how many individuals had their information compromised but said it is likely to affect a “substantial proportion of people in America.”

Do you know more about the Snowflake account intrusions? Get in touch. To contact this reporter, get in touch on Signal and WhatsApp at +1 646-755-8849, or by email. You can also send files and documents via SecureDrop.