GoKawiilSnowflake to block password logins for service accounts after AT&T-linked breach
Following the guilty plea of hacker Connor Moucka, who used stolen but valid credentials to breach over 165 Snowflake customer accounts and steal billions of records including AT&T call logs, Snowflake is phasing out password authentication for non-human service accounts. By October 2026, all legacy service users will be forced onto the SERVICE account type, which cannot authenticate with a password at all.
GoKawiil's interpretation of the reporting above, not reported fact.
The breach succeeded not through a software flaw but through years-old credentials with no multi-factor protection, exposing how neglected non-human identities can become massive attack surfaces. Snowflake's mandatory migration forces customers to inventory, assign ownership to, and rescope access for service accounts they may have long forgotten existed, a much harder organizational task than simply swapping passwords.
- Hacker Connor Moucka breached 165+ Snowflake customers using old valid credentials, not a technical exploit.
- Snowflake is eliminating password-based authentication for service accounts via a three-phase rollout ending October 2026.
- The bigger challenge for customers is auditing ownership and access scope of legacy service accounts, not just replacing passwords.
Yubico YubiKey 5 NFC Security Key — The Snowflake breach came down to credentials with no second factor — exactly what a hardware security key prevents. The YubiKey 5 NFC plugs into USB-A or taps to a phone via NFC and works with major identity providers and password managers, making phishing-resistant MFA the default for the humans behind those service accounts.
See Yubico YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-08-26
Published there as: “Snowflake ends service-account passwords. Now comes the hard part”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.