GoKawiilStolen Qubole credentials let attacker access dozens of customers' cloud data
Security firm Sentra identified a supply-chain attack in which an attacker obtained credentials belonging to big-data platform Qubole and used the cross-account access that customer companies had granted to Qubole to pull data from more than a dozen organizations. Sentra reported the campaign to Wiz, which investigated alongside Sentra and Mandiant and has since published full research findings; the attacker reportedly moved between compromised accounts in roughly a second each.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights how standing, rarely-monitored trust granted to third-party vendors can become a single point of failure affecting many organizations at once, since none of the victims were breached directly. It suggests companies need to audit and actively monitor dormant vendor integrations and non-human identities, not just their own perimeter defenses, as these can retain sensitive-data access long after initial setup.
- Attacker used stolen Qubole vendor credentials to access multiple customers' cloud data without breaching them directly.
- More than a dozen organizations were affected, with the attacker moving between trusted accounts in about a second each.
- Wiz, Sentra, and Mandiant jointly investigated and published research on the cross-account access abuse.
Source: sentra.io, 2026-11-09
Published there as: “Supply chain attack on Qubole customers”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.