Qubole big data platform breach leads to data theft in customer AWS accounts
TL;DR
Attackers compromised the Qubole big data platform to breach dozens of customer AWS environments between October 14 and 26. Users with cross-account IAM roles trusting Qubole should immediately review CloudTrail logs and rotate all exposed credentials.
What happened
A threat actor compromised two IAM users within the Qubole big data platform to access customer AWS environments. Using the AWS STS AssumeRole API, the attacker assumed previously unused roles in accounts that had configured trust policies for Qubole.
The campaign lasted from October 14 to October 26. Once inside, the attacker surveyed cloud resources, retrieved secrets from AWS Secrets Manager and SSM Parameter Store, and read Lambda environment variables. The attacker used the TruffleHog tool to validate discovered AWS keys, Microsoft Entra ID client secrets, and Okta client credentials. Following an opportunistic approach, the actor downloaded data from all accessible S3 buckets. One victim alone lost millions of files.
Why it matters
This incident demonstrates how a single compromised identity can provide a path into dozens of separate cloud environments via cross-account trust relationships. The attacker moved with extreme speed, collecting approximately 100 passwords and keys in just seven minutes. Because the attacker targeted secrets and environment variables, the breach likely extends beyond the AWS environment to other services like Okta or Microsoft Entra ID.
Who is affected
- Companies with AWS environments that have IAM roles configured to trust the Qubole AWS account.
What to do now
- Review AWS CloudTrail logs from October 1 onward for suspicious access originating from the Qubole AWS account.
- Investigate subsequent access to AWS Secrets Manager, SSM Parameter Store, and S3 buckets.
- Rotate all exposed credentials, including AWS keys, Microsoft Entra ID client secrets, and Okta client credentials.
- Revoke all active role sessions associated with the Qubole trust relationship.
- Remove unused third-party integrations and restrict remaining roles' permissions, trusted identities, and permitted source networks.
What we don't know yet
- The exact method used to compromise the two Qubole IAM users.
- The total number of downstream victim companies.
- Whether Qubole has issued a public announcement regarding the incident.
Sources
