Hackers breach AWS environments belonging to multiple Qubole customers between October 14 and October 26, using compromised credentials tied to Qubole’s trusted AWS access, according to reporting by Wiz and repeated across outlets. The attackers are described as collecting stored secrets and copying data from customer storage.
Wiz says the activity involves the attacker using credentials for an AWS account Qubole uses to reach its customers (including 805246085872 in one account) and then assuming customer-created IAM roles that trust Qubole’s account. The theft includes secrets stored in services such as Lambda environment variables, Secrets Manager, and SSM Parameter Store, as well as data copied from S3.
The outlets generally focus on how “vendor trust” worked in this incident—customers set up IAM role trust policies so Qubole can access their AWS accounts—and note that the method used to obtain Qubole’s credentials has not been disclosed in the summaries. Some coverage adds mitigation-type guidance from Wiz, while others emphasize the breach timeline and affected parties (any organization that connected Qubole to AWS, including former customers with still-trusting roles).
