Science & Tech · Cybersecurity · 7 hrs ago
Attackers used Qubole’s AWS access to steal customer secrets and data
Attackers used credentials linked to Qubole’s AWS account to enter multiple customers’ cloud environments and steal secrets and data.
The activity began on October 14, and researchers said it affected multiple organizations, but did not give a total.
Qubole is a cloud data platform that can access customer AWS accounts through roles that customers authorize.
Some roles still trusted Qubole even when customers no longer used them, allowing the attacker to access those accounts.
The attacker searched for credentials in AWS services and copied data from S3 storage, sometimes downloading entire buckets.
Researchers have not identified who was responsible or what happened to the stolen data.
Customers with Qubole AWS roles should check CloudTrail logs from October 1 onward, especially for unusual requests from Qubole’s account.
They should rotate exposed credentials and secrets and revoke active sessions for any role the attacker may have accessed.
Attackers used credentials linked to Qubole’s AWS account to enter multiple customers’ AWS environments and steal secrets and data.
Wiz said the activity occurred from October 14 to October 26 and involved customer roles that trusted Qubole’s account.
The attackers searched for credentials in Lambda, Secrets Manager and SSM Parameter Store, and copied data from S3 buckets.
Wiz did not disclose how the attackers obtained the Qubole-linked credentials or how many organizations were affected.
Wiz advised organizations that connected Qubole to AWS to review CloudTrail logs from October 1 onward and rotate exposed credentials.
- Who
- Unknown attackers targeted multiple Qubole customers.
- What
- They used credentials linked to Qubole’s AWS account to access customer AWS environments and steal stored secrets and data.
- When
- The main activity was traced from October 14 to October 26, 2026.
- Where
- In AWS environments belonging to Qubole customers.
- Why
- Not stated. The attackers’ purpose and how they obtained the credentials were not disclosed.
This story does not have two clearly opposing sides.
In a separate campaign, an attacker used customer-owned AWS access keys set up for Qubole integrations, compromising a few cloud environments.
Wiz traced the main campaign to calls using credentials associated with Qubole’s AWS account to assume customer integration roles.
The activity continued.
The attackers began using a second IAM user from the same Qubole AWS account.
Attackers accessed multiple Qubole customers’ AWS accounts and stole stored secrets and data.
- Qubole AWS account
- 805246085872
- First identified activity
- October 14, 2026
- Main campaign period
- October 14–26, 2026
- IAM user identified by Wiz
- AIDA3W7DIFLYOLTK63SFS
- Affected services
- Lambda, Secrets Manager, SSM Parameter Store and S3
3 sources
What people are saying
broad, opportunistic supply chain campaign
multiple
Because many organizations left trust policies active even after deprecating the platform, the attacker was able to successfully assume integration roles, enumerate cloud resources, harvest secrets, and siphon data
The code is not treated as a secret, and anyone with access to the role can view it