# Snowflake customer intrusions: old credentials can remain a live attack path

Canonical: https://www.web3sec.news/blog/snowflake-stolen-credentials
Author: Raiders (https://www.web3sec.news/about)
Format: postmortem
Topic: Web2
Published: 2026-11-08
Updated: 2026-11-08
Incident date: 2024-06-10

Mandiant’s 2024 investigation connects infostealer exposure, missing MFA and cloud data theft.

## What investigators reported

Mandiant published its UNC5537 investigation on 10 June 2024. It described attackers using stolen customer credentials to access Snowflake instances and steal data for extortion. In the incidents it investigated, it did not find evidence that access originated from a breach of Snowflake’s enterprise environment.

The report identified compromised credentials, absent multifactor authentication and insufficient network restrictions as recurring conditions. The date above is the public report date for a campaign, rather than a claim that all affected organizations were compromised on one day.

## Inventory identities as carefully as databases

Our analysis: cloud security review should follow the credential from the employee device to the dataset it can export. An account with broad read access can create a serious confidentiality incident without administrative privileges or a software exploit.

Separate interactive users from service identities. Enforce appropriate strong authentication for human access, scope workload credentials to a specific job and remove unused identities. Review network policies with operational owners so emergency access does not become a permanent unrestricted path.

## Make collection detectable

Establish baselines for authentication source, client, query volume and export patterns. Alert on unusual combinations, such as a new client followed by enumeration and a large export. Retain the relevant query and access history long enough to investigate delayed reports.

If credential theft is suspected, revoke sessions and replace credentials from a trusted environment. Identify copies of the secret in local tooling, notebooks and automation. Recovery should include the source of the theft and the data accessed, rather than stopping at a password reset.

## Controls to take away

- Require strong authentication and scope data access.
- Investigate unusual exports alongside unusual logins.
- Revoke sessions and address the original credential theft.

## Sources & further reading

- [Mandiant: UNC5537 targets Snowflake customer instances, 10 June 2024](https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion)

Incident facts are attributed to the linked reports. Recommendations are Web3Sec's analysis.

[Research methodology](https://www.web3sec.news/methodology) · [Editorial policy](https://www.web3sec.news/editorial-policy) · [Send a correction](https://www.web3sec.news/contact)