Baitaphish
Security intelligence
SearchLatest briefing
Curated incident record

Snowflake customer data theft campaign linked to stolen credentials and downstream extortion

In 2024, multiple companies reported data theft and extortion attempts linked to unauthorized access to their Snowflake environments. Reporting and industry analysis described attackers using stolen credentials (often associated with infostealer infections) and, in many cases, lack of MFA on Snowflake accounts as a contributing risk factor. Snowflake stated it did not identify evidence that the activity was due to a vulnerability or breach of Snowflake’s platform itself.
First reported May 31, 2024Breachmed overall confidence
Incident library
First reportedMay 31, 2024
ActivityActivity date not specified
Last updatedFeb 2, 2026, 12:00 AM UTC
Record confidencemed

Key facts

Affected

  • Snowflake customers with compromised credentials and exposed datasets
  • Downstream customers/data subjects whose data was stored in affected Snowflake instances

Initial access

  • stolen_creds

Impact

  • data_theft
  • extortion
  • financial_loss

Attribution

UNC5537 (as tracked by industry analysis) med confidence

Industry analysis (including references to Mandiant tracking) links activity clusters such as UNC5537; definitive attribution varies by victim.

CVEs and ATT&CK

CVEs

ATT&CK techniques

T1078 · med
  • T1078: Reporting and analysis describe unauthorized access using stolen credentials in customer Snowflake accounts.

Mitigations

Now

  • Enforce MFA (preferably phishing-resistant) for Snowflake users and service accountsReduces account takeover risk from stolen passwords harvested by infostealers.

Soon

  • Rotate credentials and audit for infostealer exposure across workforce endpointsCuts off reuse of credentials that may already be circulating in criminal markets.

Later

  • Implement least privilege, network policies, and monitoring on Snowflake data access patternsLimits blast radius and improves detection of unusual bulk data access or staging behavior.

Detection ideas

Detect anomalous Snowflake logins and first-time client/IP usage

Alert on first-time IPs/ASNs, unusual geographies, and sudden access from residential proxy/VPN infrastructure.

Data sources: Snowflake access logs, IdP sign-in logs, SIEM

Detect bulk data reads/exports and unusual query patterns

Alert on large queries across many tables, large export operations, and rapid enumeration inconsistent with normal workloads.

Data sources: Snowflake query logs, DLP alerts

Sources