International
The Morning Dev

Only the news worth knowing

‹
 
B48/100

Breach · high

Qubole cross-account access abused in supply chain attack hitting over a dozen organizations

Tier B · Patch this week – Put it in the sprint

Who’s exposed: Customers of Qubole with AWS cross-account integration roles

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Exploited in the wild · Full takeover · Secrets exposed

What to do

  1. Review CloudTrail logs for AssumeRole activity from Qubole's AWS account during October 14–26 and hunt for suspicious access, following Wiz's guidance.
  2. Rotate secrets and credentials stored in S3 buckets that were accessible through Qubole integration roles.

The Brief

  • Attackers used IAM credentials from Qubole's AWS account to assume integration roles in customer AWS environments.
  • Multiple Qubole customers were breached between October 14 and October 26, with stored secrets and data stolen from S3 buckets, according to Wiz.
  • Wiz published its observations and hunting guidance on 2026-11-09.

Why it matters

Customers who trusted Qubole's cross-account integration roles may have had secrets and data in their AWS accounts accessed by an unknown attacker, so teams using Qubole should check their environments for this activity.

The checklist behind the tier

Checklist · 4 of 10 yes
YesHits tech teamsJudgment: Qubole is a cloud data processing platform used by data and ops teams to run cloud workloads.
NoCore infrastructureJudgment: a single vendor's data platform, not software nearly every team runs like OpenSSH or GitHub.
NoPopular toolJudgment: Qubole is a specialised data platform with a limited user base, not a mainstream developer tool.
YesExploited in the wildWiz Blog: a threat actor used Qubole's IAM credentials to assume roles in customer AWS environments.
NoPublic exploitNo source says exploit code or a step-by-step proof-of-concept was published.
NoRemote, no loginThe Register: attackers used compromised IAM credentials, so authentication was required.
YesFull takeoverThe Hacker News: attacker broke into AWS accounts belonging to multiple Qubole customers.
YesSecrets exposedThe Hacker News: attacker stole stored secrets and data from customer AWS accounts, per Wiz.
NoSupply chainThe Register: compromised IAM credentials were used; no source says malicious code was shipped through a package, update or pipeline.
NoNo fix yetNo source states whether a fix or remediation has been shipped or is outstanding.

Timeline

  1. Attacker begins accessing customer AWS accounts via Qubole credentials

  2. Unauthorized access to customer AWS accounts ends

  3. Wiz publishes findings on the abuse of Qubole cross-account access

  4. Wiz Blog | RSS feed

    Trusted by Default: Qubole Cross-Account Access Abused in the Wild

  5. The Hacker News

    Hackers Exploit Qubole's Trusted AWS Access to Breach Customer Accounts and Steal Data

  6. www.theregister.com - Articles

    Attackers backdoor trusted AWS integrations to steal secrets

  7. SecurityWeek

    Over a Dozen Organizations Hit in Qubole Supply Chain Attack

Full coverage · 4 sources

First seen · 4 sources · Full story page · How tiers are decided