Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data
Summary: An attacker broke into AWS accounts belonging to multiple Qubole customers between October 14 and October 26, using credentials for an AWS account that Qubole's platform uses to reach those customers, and stole stored secrets and data, according to Wiz. Every AssumeRole request tied to the attacker carried an External ID and was accepted, and most of the roles the attacker assumed were unused but still trusted Qubole's account.
What's compelling: The External ID that AWS treats as a safeguard is not a secret and can be viewed by anyone with access to the role, so a trusted third-party account (805246085872) became the way into customers who had long stopped using the platform. Several victims lacked the S3 data event or access logs needed to determine which objects were read, leaving them unable to scope what was taken.
Read the original at The Hacker News ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026